HTTP: MLflow artifact_location Directory Traversal

This signature detects attempts to exploit a known vulnerability against MLflow. A successful attack can lead to directory traversal and arbitrary code execution.

Extended Description

A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.

Affected Products

Lfprojects mlflow

References

CVE: CVE-2023-6909

Short Name

HTTP:DIR:MLFLOW-ARTIFACT-LOCAON

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP: MLflow artifact_location Directory Traversal

Extended Description

Affected Products

References

Found a potential security threat?