CVE-2024-2928

Advisory

Affected versions of Mlflow are vulnerable to Local File Inclusion (LFI). This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298
• https://github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2928