CVE-2024-8859: MLflow Path Traversal Vulnerability

CVE-2024-8859 Overview

CVE-2024-8859 is a path traversal vulnerability [CWE-29] in mlflow/mlflow version 2.15.1. The flaw resides in how MLflow handles URLs when the Databricks File System (dbfs) service is configured. The application concatenates user-supplied URLs directly into the file protocol and validates only the path component, ignoring query strings and parameters. Attackers can exploit this weakness to read arbitrary files from the host when the dbfs service is mounted to a local directory. The vulnerability requires no authentication and can be triggered remotely over the network.

Critical Impact
Remote attackers can read arbitrary files from MLflow servers that have dbfs configured and mounted locally, exposing sensitive model artifacts, credentials, and configuration data.

Affected Products

MLflow (lfprojects:mlflow) version 2.15.1
Deployments with the dbfs service configured
Environments where dbfs is mounted to a local directory

Discovery Timeline

2025-03-20 - CVE-2024-8859 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8859

Vulnerability Analysis

The vulnerability is a path traversal flaw [CWE-29] affecting MLflow's dbfs source validation logic. MLflow allows users to reference model artifact sources through URLs. When dbfs is configured, MLflow constructs a file:// URL by concatenating the supplied source and passes it to the filesystem layer. The validation routine _validate_non_local_source_contains_relative_paths in mlflow/server/handlers.py inspects only the parsed path portion of the URL. Query parameters, fragments, and other URL components are excluded from the traversal check. Attackers can embed .. sequences in these unchecked regions, bypass validation, and reach files outside the intended dbfs mount point.

Root Cause

The root cause is incomplete input validation on URL-based source values. The validator uses urllib.parse.urlparse(source).path and applies traversal checks only to that substring. Because Python's URL parsing separates query and fragment components from the path, an attacker can place .. segments outside the path portion. When the final URL is later resolved into a filesystem path, the traversal sequences are honored, allowing arbitrary file reads.

Attack Vector

An unauthenticated remote attacker sends a crafted request to an MLflow server that has dbfs configured and mounted. The attacker supplies a source URL containing .. segments within query or parameter components. The server passes validation, resolves the URL to a filesystem path, and returns file contents outside the intended dbfs directory. This exposes confidential files readable by the MLflow process, including credentials, model data, and system configuration.

python

# Patch from mlflow/server/handlers.py (commit 7791b8cd)
     while (unquoted := urllib.parse.unquote_plus(source)) != source:
         source = unquoted
     source_path = re.sub(r"/+", "/", urllib.parse.urlparse(source).path.rstrip("/"))
-    if "\\x00" in source_path:
+    if "\\x00" in source_path or any(p == ".." for p in source.split("/")):
         raise MlflowException(invalid_source_error_message, INVALID_PARAMETER_VALUE)
     resolved_source = pathlib.Path(source_path).resolve().as_posix()

Source: MLflow GitHub Commit 7791b8cd

The fix inspects the full raw source string for .. segments rather than only the parsed path, blocking traversal payloads hidden in query or parameter components.

Detection Methods for CVE-2024-8859

Indicators of Compromise

MLflow HTTP requests containing .. sequences in URL query strings or parameters targeting model or artifact endpoints
Access log entries referencing file:// sources with URL-encoded traversal characters such as %2e%2e%2f
MLflow process reads of files outside the configured dbfs mount path (for example, /etc/passwd, ~/.aws/credentials, or .env files)
Unexpected artifact registration requests originating from external or unauthenticated network sources

Detection Strategies

Inspect MLflow REST API traffic for source parameters containing traversal patterns in query strings, fragments, or URL-encoded forms
Correlate MLflow process file-access telemetry with the configured dbfs mount directory and alert on reads outside that boundary
Deploy web application firewall rules that decode URL parameters before matching traversal signatures

Monitoring Recommendations

Enable MLflow server access logging and forward logs to a centralized analytics platform for path traversal pattern matching
Monitor filesystem access by the MLflow service account, alerting on reads of sensitive paths such as /etc/, /root/, and credential stores
Track MLflow version inventory to identify hosts still running 2.15.1 or earlier with dbfs enabled

How to Mitigate CVE-2024-8859

Immediate Actions Required

Upgrade MLflow to a version containing commit 7791b8cd or later, which enforces traversal checks on the full source string
Audit dbfs configuration and disable the service on MLflow instances that do not require it
Review MLflow server access logs for prior requests containing .. in URL query strings or encoded forms
Restrict network access to MLflow management endpoints using firewall rules or reverse-proxy authentication

Patch Information

The fix is available in the MLflow repository via commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654. The patch updates _validate_non_local_source_contains_relative_paths in mlflow/server/handlers.py to reject any source containing .. segments regardless of URL component. Vulnerability details and reproduction steps are documented in the Huntr bounty report.

Workarounds

Unmount dbfs from local directories on affected MLflow servers until patching is complete
Run the MLflow service under a low-privilege account with filesystem access limited to required directories
Place MLflow behind an authenticating reverse proxy and block unauthenticated requests to artifact and model source endpoints
Apply web application firewall rules that reject URL-encoded traversal sequences (%2e%2e%2f, ..%2f) in any request component

bash

# Upgrade MLflow to a patched version
pip install --upgrade mlflow

# Verify the installed version
python -c "import mlflow; print(mlflow.__version__)"

# Restrict MLflow service account filesystem access (example)
chown -R mlflow:mlflow /var/lib/mlflow
chmod 750 /var/lib/mlflow