id: PYSEC-2024-239
modified: 2025-04-08T10:23:24.852109Z
published: 2024-06-06T19:15:51Z
aliases:
- CVE-2024-0520
- GHSA-5q6c-ffvg-xcm9
details: A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution
  due to improper neutralization of special elements used in an OS command ('Command
  Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically,
  when loading a dataset from a source URL with an HTTP scheme, the filename extracted
  from the `Content-Disposition` header or the URL path is used to generate the final
  file path without proper sanitization. This flaw enables an attacker to control
  the file path fully by utilizing path traversal or absolute path techniques, such
  as '../../tmp/poc.txt' or '/tmp/poc.txt', leading to arbitrary file write. Exploiting
  this vulnerability could allow a malicious user to execute commands on the vulnerable
  machine, potentially gaining access to data and model information. The issue is
  fixed in version 2.9.0.
affected:
- package:
    ecosystem: PyPI
    name: mlflow
    purl: pkg:pypi/mlflow
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 400c226953b4568f4361bc0a0c223511652c2b9d
    - fixed: 400c226953b4568f4361bc0a0c223511652c2b9d
    repo: https://github.com/mlflow/mlflow
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.9.0
  versions:
  - 0.0.1
  - 0.1.0
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 0.4.0
  - 0.4.1
  - 0.4.2
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.6.0
  - 0.7.0
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.9.0
  - 0.9.0.1
  - 0.9.1
  - 1.0.0
  - 1.1.0
  - 1.1.1.dev0
  - 1.10.0
  - 1.11.0
  - 1.12.0
  - 1.12.1
  - "1.13"
  - 1.13.1
  - 1.14.0
  - 1.14.1
  - 1.15.0
  - 1.16.0
  - 1.17.0
  - 1.18.0
  - 1.19.0
  - 1.2.0
  - 1.20.0
  - 1.20.1
  - 1.20.2
  - 1.21.0
  - 1.22.0
  - 1.23.0
  - 1.23.1
  - 1.24.0
  - 1.25.0
  - 1.25.1
  - 1.26.0
  - 1.26.1
  - 1.27.0
  - 1.28.0
  - 1.29.0
  - 1.3.0
  - 1.30.0
  - 1.30.1
  - 1.4.0
  - 1.5.0
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.8.0
  - 1.9.0
  - 1.9.1
  - 2.0.0
  - 2.0.0rc0
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.8.0
  - 2.8.1
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
references:
- type: EVIDENCE
  url: https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc
- type: FIX
  url: https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d
- type: FIX
  url: https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc
- type: REPORT
  url: https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc
- type: WEB
  url: https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc
- type: ADVISORY
  url: https://github.com/advisories/GHSA-5q6c-ffvg-xcm9