Cloudanix VulnDB

CVE-2024-4263

Medium · 5.4

CVSS

5.4

EPSS

0.3%

Published

May 16, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

Users allowed only to edit experiments can also delete experiment files they should not be able to remove.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Broken access control allows authenticated users holding only EDIT permission on an experiment to issue DELETE requests that remove arbitrary artifact directories and files.

Why it matters to the business

Attackers or malicious insiders can cause irreversible loss of machine-learning experiment outputs and model artifacts, disrupting research workflows and requiring costly recovery efforts.

How an attack unfolds

An attacker obtains a low-privilege account with EDIT rights on a target experiment, crafts a DELETE HTTP request against the artifact endpoint, and successfully removes directories that the permission model should protect.

How to fix it

Upgrade mlflow to a build containing commit b43e0e3de5b500554e13dc032ba2083b2d6c94b8 or 328242e01b766129396415be219cb96127097501 and upgrade gitpython to commit ca965ecc81853bca7675261729143f54e5bf4cdd. Enforce least-privilege access and monitor artifact-modification API calls until patches are applied.

How to confirm the fix worked

Verify the running mlflow version is at or above the fixed commits, then attempt an artifact DELETE with an EDIT-only account and confirm the request is rejected.

Typical attack path

  1. Obtain or compromise an account possessing only EDIT permission on the target experiment
  2. Identify the artifact URI or experiment identifier via the MLflow UI or API
  3. Send a crafted DELETE request to the artifact deletion endpoint
  4. Confirm deletion of files or directories that should have been immutable under EDIT rights

How to detect it

Search MLflow server access logs for DELETE requests to artifact paths issued by users whose permission level is documented as EDIT-only; correlate with experiment ownership records.

  • DELETE /api/2.0/mlflow/artifacts
  • artifact delete request from EDIT-permission subject

What your security team should do

  • Immediately upgrade all MLflow deployments to the listed fixed commits
  • Audit current experiment permissions and revoke EDIT rights from any accounts that do not require artifact deletion capability
  • Add logging and alerting on DELETE operations targeting artifact endpoints
  • Review downstream dependents that embed the vulnerable mlflow or gitpython versions

The record

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them.

Affected packages

Ecosystem Package Introduced Fixed
PyPI mlflow 0 b43e0e3de5b500554e13dc032ba2083b2d6c94b8
PyPI mlflow 0 2.10.1
Bitnami mlflow 0 2.12.1

Related vulnerabilities