CVE-2024-2928: Local File Inclusion in mlflow
(updated )
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application’s failure to properly validate URI fragments for directory traversal sequences such as ‘../’. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like ‘/etc/passwd’. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI’s query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
References
- github.com/advisories/GHSA-j46q-5pxx-8vmw
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/commit/96f0b573a73d8eedd6735a2ce26e08859527be07
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-242.yaml
- huntr.com/bounties/19bf02d7-6393-4a95-b9d0-d6d4d2d8c298
- nvd.nist.gov/vuln/detail/CVE-2024-2928
Code Behaviors & Features
Detect and mitigate CVE-2024-2928 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →