CVE-2024-24592: Clear ClearML Auth Bypass Vulnerability

CVE-2024-24592 Overview

CVE-2024-24592 is a critical authentication bypass vulnerability affecting the fileserver component of Allegro AI's ClearML platform. The vulnerability stems from a complete lack of authentication controls, allowing remote attackers to arbitrarily access, create, modify, and delete files on affected systems without any credentials or authorization.

ClearML is a popular open-source MLOps platform used for machine learning experiment management, data versioning, and model deployment. The fileserver component handles file storage operations for ML artifacts, datasets, and model files, making this vulnerability particularly severe in machine learning pipeline environments.

Critical Impact

Remote attackers can gain unauthorized access to sensitive ML artifacts, training data, and model files. They can also inject malicious content, delete critical assets, or compromise the integrity of the entire ML supply chain without authentication.

Affected Products

• Clear ClearML (all versions of the fileserver component)

Discovery Timeline

• 2024-02-06 - CVE-2024-24592 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24592

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication) and CWE-425 (Direct Request/Forced Browsing). The fileserver component in ClearML fails to implement any authentication mechanism, leaving all file operations completely exposed to network-accessible attackers.

The impact is severe across all three security pillars: confidentiality is compromised as attackers can read sensitive training data and model files; integrity is violated through unauthorized file creation and modification capabilities; and availability is threatened through the ability to delete files arbitrarily.

In MLOps environments, this vulnerability poses significant supply chain risks. Attackers could inject poisoned training data, replace legitimate models with backdoored versions, or exfiltrate proprietary datasets and intellectual property without leaving authentication traces.

Root Cause

The root cause is the absence of authentication controls in the fileserver component's design. The component processes file operation requests (read, write, create, delete) without verifying the identity or authorization level of the requesting client. This represents a fundamental security architecture flaw rather than an implementation bug.

Attack Vector

The attack is network-based and requires no privileges, user interaction, or special conditions to exploit. An attacker with network access to the ClearML fileserver can directly interact with file operations by crafting HTTP requests to the exposed endpoints.

Attack scenarios include:

Data Exfiltration: Remote attackers can enumerate and download sensitive files including training datasets, model weights, configuration files, and experiment logs without authentication.

Model Poisoning: Attackers can upload malicious model files or modify existing models, potentially introducing backdoors that persist through the ML pipeline into production systems.

Supply Chain Compromise: By manipulating artifacts stored in the fileserver, attackers can compromise downstream processes that consume these files, affecting model training and deployment workflows.

For detailed technical analysis of this vulnerability and related MLOps security issues, see the HiddenLayer research article.

Detection Methods for CVE-2024-24592

Indicators of Compromise

• Unexpected file access patterns or API calls to the ClearML fileserver from unauthorized IP addresses
• Creation, modification, or deletion of files without corresponding authenticated user activity in application logs
• Anomalous network traffic to the fileserver component ports from external or unexpected sources
• New or modified model files, datasets, or artifacts that don't correspond to legitimate user operations

Detection Strategies

• Implement network traffic monitoring to detect unauthorized access attempts to the fileserver component
• Deploy file integrity monitoring (FIM) to detect unauthorized modifications to stored artifacts
• Enable comprehensive logging of all fileserver operations and correlate with authenticated user sessions
• Configure intrusion detection systems (IDS) with rules for detecting direct file manipulation requests

Monitoring Recommendations

• Monitor network connections to the ClearML fileserver for connections from unauthorized sources
• Track file system changes on the fileserver storage backend for unexpected modifications
• Implement alerting for high-volume file operations that may indicate data exfiltration
• Review access logs regularly for patterns inconsistent with normal ML workflow operations

How to Mitigate CVE-2024-24592

Immediate Actions Required

• Restrict network access to the ClearML fileserver component using firewall rules and network segmentation
• Place the fileserver behind an authentication proxy or reverse proxy with proper access controls
• Audit existing files for signs of unauthorized access, modification, or malicious content injection
• Implement network-level access controls to limit connectivity to trusted internal systems only

Patch Information

At the time of publication, no vendor advisory or specific patch information is available for this vulnerability. Organizations should monitor the ClearML GitHub repository and official channels for security updates. Contact Allegro AI directly for guidance on remediation options for your specific deployment.

Workarounds

• Deploy the ClearML fileserver on an isolated network segment accessible only to authorized internal systems
• Implement a reverse proxy with authentication (such as OAuth2 Proxy or similar) in front of the fileserver
• Use network ACLs and security groups to restrict access to known ML pipeline components only
• Consider disabling the fileserver component if not required, or use alternative authenticated storage backends

# Example: Restrict fileserver access using iptables
# Allow only internal ML pipeline hosts
iptables -A INPUT -p tcp --dport 8081 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP

# Example: Deploy with authentication proxy using Docker Compose
# Place behind OAuth2 Proxy or similar authenticated reverse proxy