ExploitCVE-2023-1177
Path Traversal: '\..\filename' (CWE-29)
Summary
A path traversal vulnerability exists in the GitHub repository mlflow/mlflow prior to version 2.2.1. This vulnerability is specifically related to the '\..\filename' path traversal technique.
Impact
This vulnerability has a CVSS v3.1 base score of 9.8, which is considered Critical. The attack vector is Network-based, requires low attack complexity, and needs no user interaction or privileges. It can lead to high impacts on confidentiality, integrity, and availability of the affected system. Attackers could potentially access or modify files outside of the intended directory structure, leading to unauthorized data access, data manipulation, or system compromise.
Exploitation
Multiple proof-of-concept exploits are available on huntr.dev, github.com, github.com, github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. The vulnerability has been fixed in MLflow version 2.2.1 and later. Multiple patch sources are available, including the official GitHub advisory and the MLflow GitHub repository.
Mitigation
1. Upgrade MLflow to version 2.2.1 or later immediately. 2. If immediate upgrading is not possible, implement strict input validation and sanitization for file paths. 3. Apply the principle of least privilege to limit potential damage from exploitation. 4. Monitor system logs for any suspicious file access attempts. 5. Implement network segmentation to limit the exposure of vulnerable systems.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2023-1177. See article
The vulnerability CVE-2023-1177 in MLflow poses a critical risk as it allows for a combined Local File Inclusion/Remote File Inclusion attack, potentially leading to a complete system or cloud provider takeover. Organizations are urged to update to at least version 2.2.2 immediately to mitigate this risk. Proof-of-concept exploits are available, and downstream impacts to third-party vendors using MLflow may be significant if left unaddressed. See article
EPSS Score was set to: 1.5% (Percentile: 85.3%)