CVE-2024-3848

描述

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.

如何修補 CVE-2024-3848

要修補 CVE-2024-3848,請將受影響套件升級到下列已修補版本。

• —升級至 2.12.1 或更新版本
• —升級至 2.12.1 或更新版本
• —升級至 f8d51e21523238280ebcfdb378612afd7844eca8 或更新版本

CVE-2024-3848 正在被利用嗎?

中等 — EPSS 為 43.3%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 2.12.1
• >= 2.9.2, < 2.12.1
• from 0, < f8d51e21523238280ebcfdb378612afd7844eca8, < f8d51e21523238280ebcfdb378612afd7844eca8 | from 0, < 2.12.1

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-rfqq-wq6w-72jm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-3848
• PATCHgithub.com/mlflow/mlflow
• WEBgithub.com/mlflow/mlflow/commit/f8d51e21523238280ebcfdb378612afd7844eca8