Remote Code Execution due to Full Controled File Write in mlflow
GHSA-5p3h-7fwh-92rc · BIT-mlflow-2023-6018 · CVE-2023-6018 · PYSEC-2026-417
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting /home/<user>/.bashrc). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
Ready to move
Start Securing
Free, no credit card | First findings in minutes