CVE-2024-3573

描述

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.

如何修補 CVE-2024-3573

要修補 CVE-2024-3573,請將受影響套件升級到下列已修補版本。

• —升級至 2.10.0 或更新版本
• —升級至 2.10.0 或更新版本
• —升級至 438a450714a3ca06285eeea34bdc6cf79d7f6cbc 或更新版本

CVE-2024-3573 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.10.0
• from 0, < 2.10.0
• from 0, < 438a450714a3ca06285eeea34bdc6cf79d7f6cbc, < 438a450714a3ca06285eeea34bdc6cf79d7f6cbc | from 0, < 2.10.0

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-hq88-wg7q-gp4g
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-3573
• PATCHgithub.com/mlflow/mlflow
• WEBgithub.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc