CVE-2024-3848

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-3848

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3848.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-3848

Aliases

Published

2024-05-16T09:15:14.543Z

Modified

2026-02-22T07:48:45.626910Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.

References

Affected packages

Git / github.com/mlflow/mlflow

Affected ranges

Type: GIT
Repo: https://github.com/mlflow/mlflow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

328242e01b766129396415be219cb96127097501

Affected versions

1.*

1.0.0

v0.*

v0.2.0

v0.2.1

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.6.0

v0.7

v0.8.0

v0.8.1

v1.*

v1.7.0

v2.*

v2.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3848.json"

vanir_signatures

[
    {
        "id": "CVE-2024-3848-0490fec7",
        "target": {
            "file": "mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/mlflow/mlflow/commit/328242e01b766129396415be219cb96127097501",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "331374387258698623515503197375262902471",
                "56531494967603305558894176301696978897",
                "156845208350900572074037141806451871031",
                "236113965666297154310270274411699188635"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2024-3848-54219b73",
        "target": {
            "function": "doGet",
            "file": "mlflow/java/scoring/src/main/java/org/mlflow/sagemaker/ScoringServer.java"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/mlflow/mlflow/commit/328242e01b766129396415be219cb96127097501",
        "digest": {
            "function_hash": "103832320670295227953645632588587077659",
            "length": 189.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-3848-9f1fee19",
        "target": {
            "function": "testScoringServerWithValidPredictorRespondsToVersionCorrectly",
            "file": "mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/mlflow/mlflow/commit/328242e01b766129396415be219cb96127097501",
        "digest": {
            "function_hash": "248178710733966095301624193790593745960",
            "length": 483.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2024-3848-d79dc76d",
        "target": {
            "file": "mlflow/java/scoring/src/test/java/org/mlflow/ScoringServerTest.java"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/mlflow/mlflow/commit/328242e01b766129396415be219cb96127097501",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "227586388277291964245723347465144503129",
                "214612006548484888068671228559130409821",
                "141702509437346544668394886097631250819",
                "44304877576058785675745254216915397335"
            ]
        },
        "signature_type": "Line"
    }
]