« Volver al listado

CVE-2024-8859

Estado: AnalizadaAlta (7.5)—

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de traversal en API de MLflow (AV:N, PR:N, UI:N) expuesta en red sin autenticación. Permite lectura arbitraria de archivos locales via protocolo file:// en servicio dbfs montado localmente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementLimit Access to Resource Over NetworkFilter Network TrafficUpdate SoftwareActive Directory ConfigurationVulnerability Scanning

Tecnologías afectadas (1)

Lfprojects — Mlflow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8859",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8859",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-20T17:52:43.545684Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "mlflow",
          "product": "mlflow/mlflow",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.17.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-20T10:15:44.463",
  "references": [
    {
      "url": "https://github.com/mlflow/mlflow/commit/7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654",
      "tags": [
        "Patch"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/2259b88b-a0c6-4c7c-b434-6aacf6056dcb",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-29"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de path traversal en mlflow/mlflow versión 2.15.1. Cuando los usuarios configuran y utilizan el servicio dbfs, la concatenación de la URL directamente en el protocolo de archivo genera una vulnerabilidad de lectura de archivos arbitrarios. Este problema se produce porque solo se verifica la parte de la ruta de la URL, mientras que partes como la consulta y los parámetros no se gestionan. La vulnerabilidad se activa si el usuario ha configurado el servicio dbfs y, durante su uso, este se monta en un directorio local."
    }
  ],
  "lastModified": "2026-06-17T08:23:26.193",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lfprojects:mlflow:2.15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5093AA83-B103-4E88-BA15-C95D1449D9DF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@huntr.dev"
}