// For flags

CVE-2024-3573

Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

Severity Score

9.3
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

mlflow/mlflow es vulnerable a la inclusión de archivos locales (LFI) debido a un análisis inadecuado de los URI, lo que permite a los atacantes eludir las comprobaciones y leer archivos arbitrarios en el sistema. El problema surge de la falla de la función 'is_local_uri' para manejar adecuadamente los URI con esquemas vacíos o de 'archivo', lo que lleva a la clasificación errónea de los URI como no locales. Los atacantes pueden aprovechar esto creando versiones de modelos maliciosos con parámetros de "fuente" especialmente manipulados, lo que permite la lectura de archivos confidenciales dentro de al menos dos niveles de directorio desde la raíz del servidor.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-10 CVE Reserved
  • 2024-04-16 CVE Published
  • 2024-08-01 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-29: Path Traversal: '\..\filename'
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lfprojects
Search vendor "Lfprojects"
 Mlflow
Search vendor "Lfprojects" for product "Mlflow"
*-
Affected