CVE-2024-27133: Lfprojects MLflow XSS Vulnerability

CVE-2024-27133 Overview

CVE-2024-27133 is a critical Cross-Site Scripting (XSS) vulnerability in MLflow, an open-source platform for managing machine learning workflows. The vulnerability arises from insufficient sanitization of dataset table fields, which allows attackers to inject malicious scripts when a recipe processes an untrusted dataset. This issue is particularly dangerous because it can lead to client-side Remote Code Execution (RCE) when the affected recipe is executed within Jupyter Notebook environments.

Critical Impact

This vulnerability enables client-side RCE through XSS when running MLflow recipes with untrusted datasets in Jupyter Notebook, potentially allowing attackers to execute arbitrary code in the context of the victim's session.

Affected Products

• lfprojects mlflow (all versions prior to patch)

Discovery Timeline

• 2024-02-23 - CVE-2024-27133 published to NVD
• 2025-01-22 - Last updated in NVD database

Technical Details for CVE-2024-27133

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Cross-Site Scripting), specifically a stored XSS variant that manifests through dataset table fields in MLflow. The vulnerability exploits the lack of proper input sanitization when MLflow processes and renders dataset contents within recipe workflows.

When a user runs a recipe that utilizes an untrusted or maliciously crafted dataset, the unsanitized table field data is rendered directly in the client interface. In Jupyter Notebook environments, this execution context is particularly dangerous as the XSS payload can escalate to full client-side RCE, allowing the attacker to execute arbitrary code with the privileges of the notebook user.

The attack requires network access and user interaction (the victim must run a recipe with the malicious dataset), but the impact is severe as it crosses security boundaries and can compromise confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of CVE-2024-27133 is the absence of proper input sanitization and output encoding for dataset table fields within MLflow. When datasets are loaded and processed through MLflow recipes, the platform fails to sanitize or escape potentially dangerous content before rendering it in the user interface. This allows HTML and JavaScript content embedded in dataset fields to be executed in the browser context.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can craft a malicious dataset containing XSS payloads in table field values. When a victim downloads or accesses this untrusted dataset and runs an MLflow recipe that processes it, the malicious script executes in the victim's browser. In Jupyter Notebook environments, the execution context allows the attacker to escalate from XSS to RCE, potentially executing system commands, accessing sensitive data, or establishing persistence.

The attack flow involves:

1. Attacker creates a dataset with malicious JavaScript embedded in table fields
2. Victim obtains the dataset (through sharing, download, or repository access)
3. Victim runs an MLflow recipe that processes the dataset
4. The unsanitized payload executes in the victim's browser/notebook context
5. In Jupyter environments, the attacker gains RCE capabilities

Detection Methods for CVE-2024-27133

Indicators of Compromise

• Unexpected JavaScript execution or browser alerts when processing datasets in MLflow
• Unusual network requests originating from Jupyter Notebook sessions
• Dataset files containing suspicious HTML or JavaScript content in table fields
• Anomalous system commands or processes spawned from Jupyter/notebook processes

Detection Strategies

• Monitor MLflow recipe executions for datasets from untrusted sources
• Implement content security policies (CSP) to detect and block inline script execution
• Review datasets for embedded script tags or JavaScript event handlers before processing
• Enable browser developer console logging to detect XSS payload execution attempts

Monitoring Recommendations

• Configure web application firewalls (WAF) to monitor for XSS patterns in dataset content
• Implement logging for MLflow recipe executions with dataset source tracking
• Monitor Jupyter Notebook environments for suspicious child process creation
• Enable audit logging for file access and network connections from ML workflow environments

How to Mitigate CVE-2024-27133

Immediate Actions Required

• Update MLflow to the latest patched version that addresses this vulnerability
• Avoid running recipes with datasets from untrusted or unverified sources
• Implement strict dataset validation and sanitization before processing
• Consider running MLflow recipes in isolated environments without network access when processing untrusted data

Patch Information

The MLflow development team has addressed this vulnerability through GitHub Pull Request #10893. Users should update to the patched version by pulling the latest MLflow release that includes this fix. The patch implements proper sanitization for dataset table fields to prevent XSS payloads from executing.

For detailed technical information about the vulnerability, refer to the JFrog Vulnerability Report.

Workarounds

• Implement manual sanitization of dataset content before loading into MLflow recipes
• Use Content Security Policy headers to prevent inline script execution
• Run untrusted dataset processing in sandboxed environments without browser access
• Disable JavaScript execution in Jupyter Notebook rendering when working with external datasets

# Update MLflow to the latest patched version
pip install --upgrade mlflow

# Verify installed version
pip show mlflow | grep Version