CVE-2024-24591: Clear ClearML Path Traversal Vulnerability

CVE-2024-24591 Overview

CVE-2024-24591 is a path traversal vulnerability affecting the client SDK of Allegro AI's ClearML platform, an open-source MLOps solution used for experiment tracking, model management, and dataset versioning. This vulnerability exists in versions 1.4.0 to 1.14.1 of the ClearML client SDK and enables a maliciously crafted dataset to write local or remote files to arbitrary locations on an end user's system when the dataset is interacted with.

Critical Impact

Attackers can leverage this path traversal vulnerability to overwrite critical system files, plant malicious code, or compromise machine learning pipelines by manipulating dataset artifacts that write to arbitrary filesystem locations.

Affected Products

• ClearML Client SDK versions 1.4.0 through 1.14.1
• Allegro AI ClearML Platform (when using vulnerable SDK versions)
• ML/AI pipelines and workflows utilizing affected ClearML client versions

Discovery Timeline

• 2024-02-06 - CVE CVE-2024-24591 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24591

Vulnerability Analysis

This path traversal vulnerability (CWE-22) allows attackers to escape intended directory boundaries when a user interacts with a maliciously crafted dataset in the ClearML platform. The vulnerability is particularly dangerous in the context of MLOps environments where datasets are frequently shared among team members and automated pipelines regularly process external data sources.

The attack can be executed remotely without authentication, though it requires user interaction—specifically, a victim must interact with the malicious dataset for the exploit to succeed. Successful exploitation grants attackers the ability to achieve high impact across confidentiality, integrity, and availability vectors, enabling arbitrary file writes that could lead to code execution, data tampering, or system compromise.

Root Cause

The root cause of CVE-2024-24591 lies in improper validation and sanitization of file paths within the ClearML client SDK's dataset handling functionality. When processing dataset artifacts, the SDK fails to adequately validate path components, allowing directory traversal sequences (such as ../) to escape the intended storage directory. This oversight enables malicious actors to craft dataset entries with specially constructed paths that, when processed, write files to locations outside the expected dataset directory structure.

Attack Vector

The attack exploits the trust relationship between ClearML users and shared datasets within the platform. An attacker creates a malicious dataset containing artifacts with path traversal sequences in their filenames or storage paths. When a victim downloads or interacts with this dataset through the ClearML client SDK, the malicious paths are processed without proper sanitization.

The attack flow involves:

1. The attacker uploads a dataset to a shared ClearML server with artifacts containing path traversal sequences
2. A victim user or automated pipeline fetches or processes the malicious dataset
3. The ClearML client SDK writes the artifact content to an attacker-controlled location on the victim's filesystem
4. Depending on the written content and location, this can result in code execution, credential theft, or pipeline compromise

The vulnerability is especially concerning in CI/CD and automated ML training environments where datasets are processed automatically without human review of their contents.

Detection Methods for CVE-2024-24591

Indicators of Compromise

• Presence of files in unexpected system directories that were not intentionally placed there
• Unusual file creation events in system directories, home folders, or configuration paths during ClearML dataset operations
• Dataset artifacts containing path traversal sequences (../, ..\\, or URL-encoded variants like %2e%2e%2f)
• Unexpected modifications to configuration files, scripts, or executable paths following ClearML dataset interactions

Detection Strategies

• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized writes during dataset processing
• Audit ClearML dataset metadata and artifact paths for suspicious patterns including ../ sequences before downloading
• Monitor process execution to identify the ClearML client writing files outside expected dataset directories
• Deploy endpoint detection rules that alert on path traversal patterns in file operations initiated by Python processes

Monitoring Recommendations

• Enable detailed logging for all ClearML SDK operations, particularly dataset downloads and artifact extractions
• Configure alerts for file system operations that attempt to write outside designated ClearML cache and dataset directories
• Monitor network traffic for large dataset transfers from untrusted or newly added ClearML servers
• Implement anomaly detection for sudden changes in ML pipeline behavior following dataset updates

How to Mitigate CVE-2024-24591

Immediate Actions Required

• Upgrade ClearML client SDK to a version newer than 1.14.1 that includes the path traversal fix
• Audit existing datasets for suspicious artifact paths before continued use
• Restrict dataset sources to trusted internal repositories until patching is complete
• Review file system permissions to limit the impact of potential arbitrary writes

Patch Information

Organizations using ClearML should upgrade their client SDK beyond version 1.14.1 to address this vulnerability. Review the HiddenLayer Research Analysis for additional context on the vulnerability and recommended remediation steps. Ensure all development environments, CI/CD systems, and production ML pipelines are updated to use the patched version of the ClearML client.

Workarounds

• Implement strict allowlisting of dataset sources and reject datasets from untrusted origins
• Deploy wrapper scripts that validate all artifact paths before allowing ClearML SDK to process datasets
• Run ClearML operations in sandboxed or containerized environments with limited filesystem access
• Configure filesystem permissions to prevent the ClearML user from writing to sensitive directories

# Configuration example - Run ClearML in restricted environment
# Create a dedicated user with limited permissions
useradd -r -s /bin/false clearml-worker

# Restrict ClearML cache to a specific directory
export CLEARML_CACHE_DIR=/var/lib/clearml/cache

# Set restrictive permissions on the cache directory
mkdir -p /var/lib/clearml/cache
chown clearml-worker:clearml-worker /var/lib/clearml/cache
chmod 700 /var/lib/clearml/cache

# Run ClearML operations as the restricted user
sudo -u clearml-worker python -m clearml_agent daemon