CVE-2024-1558: MLflow Path Traversal Vulnerability

CVE-2024-1558 Overview

CVE-2024-1558 is a path traversal vulnerability [CWE-22] in the _create_model_version() function within server/handlers.py of the mlflow/mlflow repository. The flaw stems from improper validation of the source parameter. Attackers craft a source value that bypasses the _validate_non_local_source_contains_relative_paths(source) check by abusing unquoted URL characters. The server then reuses the original unsanitized source during model version creation, allowing arbitrary file read through the /model-versions/get-artifact handler. Exploitation requires no authentication or user interaction and is performed over the network, exposing sensitive files on the MLflow tracking server.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the MLflow server filesystem, including configuration files, credentials, and machine learning artifacts.

Affected Products

lfprojects:mlflow (mlflow/mlflow repository)
MLflow tracking server deployments exposing the model registry API
Self-hosted MLflow instances with the /model-versions/get-artifact endpoint enabled

Discovery Timeline

2024-04-16 - CVE-2024-1558 published to NVD
2025-02-03 - Last updated in NVD database

Technical Details for CVE-2024-1558

Vulnerability Analysis

MLflow is an open-source platform for managing the machine learning lifecycle, including experiment tracking and model registry. The _create_model_version() handler accepts a source parameter that points to the artifact location for a new model version. Before registration, MLflow calls _validate_non_local_source_contains_relative_paths(source) to reject paths containing relative traversal sequences. The validation routine inspects the raw string but does not normalize URL-encoded characters. An attacker submits a source value containing percent-encoded traversal sequences that the validator interprets as benign. MLflow then stores the original unquoted source and resolves it on the filesystem when the client calls /model-versions/get-artifact, returning the contents of the targeted file.

Root Cause

The root cause is inconsistent handling of URL encoding between the validation and resolution stages. The validator inspects the unquoted form, while the artifact retrieval path operates on the decoded form. This parser differential lets crafted traversal sequences cross the security boundary.

Attack Vector

The attack is remote and unauthenticated. An attacker sends an HTTP request to the model registry to create a model version with a malicious source value, then issues a follow-up request to /model-versions/get-artifact to read targeted files such as /etc/passwd, application configuration, or cloud credential files. See the Huntr Bounty Report for the disclosure technical details.

No verified public exploit code is available. The vulnerability mechanism described in prose above corresponds to the bypass documented in the Huntr disclosure.

Detection Methods for CVE-2024-1558

Indicators of Compromise

HTTP POST requests to /api/2.0/mlflow/model-versions/create with a source parameter containing URL-encoded characters such as %2e%2e%2f or unusual scheme prefixes.
Subsequent GET requests to /model-versions/get-artifact referencing non-artifact filesystem paths like /etc/, /root/, or cloud credential locations.
MLflow server log entries showing successful artifact retrieval for paths outside the configured artifact root.

Detection Strategies

Inspect MLflow tracking server access logs for source values that decode to traversal sequences after URL unquoting.
Correlate model version creation events with immediate get-artifact requests targeting sensitive filesystem locations.
Apply web application firewall rules that normalize URL encoding before evaluating traversal patterns against MLflow API routes.

Monitoring Recommendations

Forward MLflow application logs and reverse proxy logs into the Singularity Data Lake using OCSF normalization for centralized querying and retention.
Build identification rules in Singularity AI SIEM that alert on path traversal patterns within source and artifact path parameters.
Monitor the MLflow process on host endpoints with Singularity Endpoint to surface unexpected reads of credential files, SSH keys, or configuration data.

How to Mitigate CVE-2024-1558

Immediate Actions Required

Upgrade MLflow to a release that includes the fix for CVE-2024-1558 referenced in the Huntr Bounty Report.
Restrict network access to the MLflow tracking server so the model registry API is reachable only from trusted internal networks.
Enforce authentication and authorization in front of MLflow using a reverse proxy or identity-aware gateway.

Patch Information

The maintainers patched the validation logic in server/handlers.py to normalize URL-encoded characters before evaluating the source parameter and to reuse the sanitized value during model version creation. Operators should pull the latest MLflow release from the mlflow/mlflow repository and verify that _validate_non_local_source_contains_relative_paths() operates on the decoded path.

Workarounds

Place MLflow behind a reverse proxy that rejects requests where the source parameter contains percent-encoded traversal sequences.
Run the MLflow tracking server as an unprivileged user with filesystem access limited to the artifact root directory.
Disable or block the /model-versions/get-artifact route at the proxy layer until the patched version is deployed.

bash

# Example nginx rule blocking encoded traversal in MLflow source parameters
location /api/2.0/mlflow/model-versions/create {
    if ($request_body ~* "%2e%2e|%2f%2e%2e|\.\./") {
        return 403;
    }
    proxy_pass http://mlflow_backend;
}

location /model-versions/get-artifact {
    if ($args ~* "%2e%2e|\.\./|/etc/|/root/") {
        return 403;
    }
    proxy_pass http://mlflow_backend;
}