Cloudanix VulnDB

CVE-2024-3099

Medium · 5.4

CVSS

5.4

EPSS

0.4%

Published

Jun 6, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Attackers can trick the system into treating differently named items as the same, which might block access to important data or let bad data slip in unnoticed.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Allows creation of multiple models with identical names via URL-encoded variants due to insufficient model name validation, enabling DoS by redirecting users to unintended models and data poisoning by substituting malicious models.

Why it matters to the business

Disrupts reliable access to machine learning models and risks unauthorized substitution of models, potentially leading to incorrect or malicious outputs in production systems.

How an attack unfolds

An authenticated attacker crafts model creation requests using URL-encoded names that decode to match existing models, bypassing uniqueness checks and allowing duplicate or poisoned model registrations.

How to fix it

Implement strict validation and normalization of model names to prevent URL encoding bypasses. Ensure model names are decoded and canonicalized prior to uniqueness enforcement.

How to confirm the fix worked

Review model name handling code for proper decoding and normalization before uniqueness checks. Test by attempting to create models with encoded names matching existing ones.

Typical attack path

  1. Authenticate to the MLflow service
  2. Identify an existing model name
  3. Create a new model using URL-encoded version of the name
  4. Induce users or systems to interact with the model name
  5. Observe redirection to attacker-controlled model or denial of access

How to detect it

Examine MLflow logs for model creation events containing URL-encoded characters in names. Search for multiple models whose decoded names collide.

What your security team should do

  • Enforce canonical model name normalization on creation
  • Audit existing models for potential encoded duplicates
  • Monitor API logs for suspicious model registration patterns
  • Upgrade to a patched MLflow release when available

The record

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.

Affected packages

Ecosystem Package Introduced Fixed
PyPI mlflow 0 2.11.3

Related vulnerabilities