CVE-2024-1560: MLflow Path Traversal Vulnerability

CVE-2024-1560 Overview

CVE-2024-1560 is a path traversal vulnerability [CWE-22] in the mlflow/mlflow repository. The flaw resides in the artifact deletion functionality of the machine learning lifecycle platform. Attackers with low privileges can bypass path validation by exploiting a double URL decoding process in the _delete_artifact_mlflow_artifacts handler and the local_file_uri_to_path function. Successful exploitation allows deletion of arbitrary directories on the server filesystem. The issue persists through version 2.9.2, even after a previous fix attempt addressed a similar flaw tracked as CVE-2023-6831.

Critical Impact
Authenticated remote attackers can delete arbitrary directories on the mlflow server, causing data loss and denial of service across MLOps environments.

Affected Products

lfprojects mlflow (all versions up to and including 2.9.2)
mlflow deployments exposing the artifact management HTTP API
Any MLOps pipeline that persists artifacts through mlflow's local artifact repository

Discovery Timeline

2024-04-16 - CVE-2024-1560 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1560

Vulnerability Analysis

The vulnerability originates in mlflow's local artifact repository implementation. The delete_artifacts function in local_artifact_repo.py performs an extra unquote operation on user-supplied paths. This second decoding step processes percent-encoded characters after path validation has already occurred. Attackers craft double-encoded traversal sequences that appear safe during validation but resolve to parent directories after the redundant decode. The mlflow server then deletes filesystem paths outside the intended artifact storage boundary.

Root Cause

The root cause is inconsistent URL decoding between the request handler and the underlying filesystem access function. The _delete_artifact_mlflow_artifacts handler and the local_file_uri_to_path function both invoke decoding routines on the same input. When a payload such as %252e%252e%252f reaches the handler, one decode yields %2e%2e%2f and a second decode produces ../. The path validation logic does not account for this double-decode chain, breaking the trust boundary between validated input and filesystem operations.

Attack Vector

Exploitation requires network access to the mlflow tracking server and a low-privileged authenticated context. An attacker sends a crafted HTTP request to the artifact deletion endpoint containing a double-URL-encoded path traversal sequence in the artifact path parameter. The server decodes the payload twice, resolves it to a location outside the artifact directory, and invokes filesystem deletion on the resulting path. The attack requires no user interaction and leaves the mlflow process with the write permissions of its runtime account. Because mlflow servers frequently run with broad access to shared storage in MLOps environments, the blast radius often extends beyond mlflow itself.

The fix for the earlier CVE-2023-6831 addressed a related traversal path but did not remove the extra unquote call in delete_artifacts. Technical details are documented in the Huntr Bug Bounty Report.

Detection Methods for CVE-2024-1560

Indicators of Compromise

HTTP requests to /api/2.0/mlflow-artifacts/artifacts or /ajax-api/2.0/mlflow/* containing double-encoded sequences such as %252e%252e%252f or %252E%252E%252F
Unexpected DELETE method requests targeting the mlflow artifact API from non-administrative users
Filesystem deletion events on the mlflow host affecting paths outside the configured artifact root directory
mlflow server logs referencing artifact URIs that resolve to system directories or sibling application data

Detection Strategies

Inspect reverse proxy and application logs for encoded traversal patterns targeting mlflow artifact endpoints
Correlate mlflow API requests with filesystem audit logs (auditd, Windows Security) to flag deletions outside MLFLOW_ARTIFACT_ROOT
Deploy web application firewall rules that decode requests iteratively before applying traversal signatures
Monitor for anomalous file or directory removal volume originating from the mlflow service account

Monitoring Recommendations

Enable verbose HTTP access logging on the mlflow tracking server and forward logs to a centralized SIEM
Alert on any successful HTTP 200 responses to artifact DELETE operations from unexpected source IP ranges
Baseline normal artifact deletion patterns per user and flag deviations in request rate or target paths
Track process activity for the mlflow service and alert on unlink or rmtree operations outside the artifact directory

How to Mitigate CVE-2024-1560

Immediate Actions Required

Upgrade mlflow to a version later than 2.9.2 that removes the redundant unquote call in delete_artifacts
Restrict network access to the mlflow tracking server so only authorized MLOps users and services can reach the artifact API
Run the mlflow server under a dedicated low-privilege account with write access limited to the artifact root directory
Audit filesystem integrity on hosts running vulnerable mlflow versions to identify prior unauthorized deletions

Patch Information

Upgrade mlflow to a release beyond 2.9.2 that eliminates the double-decoding behavior in the local artifact repository. Review the Huntr Bug Bounty Report for the specific code change addressing the extra unquote operation. Because CVE-2023-6831 was not fully remediated by earlier patches, confirm the deployed build includes the corrected _delete_artifact_mlflow_artifacts handler and local_file_uri_to_path function.

Workarounds

Place mlflow behind a reverse proxy that performs recursive URL decoding and blocks any request containing traversal sequences before forwarding
Enforce filesystem access controls that deny the mlflow service account write permission to any directory outside the artifact root
Disable the mlflow artifact proxy endpoints if artifact deletion is not required in the deployment
Require authentication and role-based authorization on all mlflow API routes to reduce the attacker population

bash

# Configuration example: block double-encoded traversal at an nginx reverse proxy
location /api/2.0/mlflow-artifacts/ {
    if ($request_uri ~* "(%25){1,}2[eE]") { return 403; }
    if ($request_uri ~* "\.\./")         { return 403; }
    proxy_pass http://mlflow_upstream;
}