CVE-2024-8859

What it actually does

This is a path traversal flaw in MLflow 2.15.1 when the DBFS artifact service is configured and mounted to a local directory. The vulnerable code validates only the path component of a DBFS URL, but then concatenates the full URL into a local file protocol path. An attacker who can cause MLflow to resolve a crafted DBFS artifact URL can place traversal or file-targeting content in URL query or parameter components that bypass path-only validation, resulting in arbitrary local file read from the MLflow server process context. Impact is primarily confidentiality loss: source code, model artifacts, credentials, environment variables, SSH keys, cloud tokens, database connection strings, and other local files readable by the MLflow process may be exposed.

Why it matters to the business

Successful exploitation can expose sensitive files from MLflow servers that often sit close to model artifacts, experiment metadata, credentials, and data science infrastructure. In practical terms, this can lead to theft of secrets, unauthorized access to connected storage or cloud resources, leakage of proprietary models or training data references, and follow-on compromise of adjacent systems. The issue is not currently listed in CISA KEV and has a relatively low EPSS score, but exploit maturity is reported as weaponized and the vulnerability has been public for a long period, so internet-facing or broadly accessible MLflow deployments using DBFS should be treated as higher priority.

How an attack unfolds

An attacker first identifies an MLflow deployment that has DBFS artifact support enabled and mounted to the local filesystem. The attacker then obtains access to an MLflow workflow or endpoint that causes the server to fetch, list, or return artifacts using a DBFS URL. Instead of supplying a normal artifact path, the attacker submits a specially crafted DBFS URL where the visible path appears acceptable, but the query string or path parameters contain traversal or file-targeting content. Because the vulnerable implementation checks only the URL path and then uses the full URL when constructing a file:// location, the attacker-controlled components influence the local file read operation. The MLflow process opens the targeted local file and returns its contents or otherwise exposes them through the artifact handling response path. The attacker then repeats the technique against high-value files such as environment files, cloud credentials, SSH keys, service configuration, MLflow configuration, and operating system account files to support credential theft and lateral movement.

How to fix it

Upgrade MLflow to a version that includes the upstream fix commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654. If deploying from source, verify that this commit or an equivalent patch is present. If using packaged MLflow releases, upgrade to the first release that incorporates that commit rather than remaining on 2.15.1. As compensating controls, disable DBFS artifact service integration where it is not required, avoid mounting DBFS to local directories for MLflow artifact handling, restrict MLflow access to trusted authenticated users, place MLflow behind network controls, and ensure the MLflow runtime identity has least-privilege filesystem and cloud permissions. Do not run MLflow with broad access to host secrets or privileged directories. Rotate credentials if there is evidence that sensitive files may have been read.

How to confirm the fix worked

Confirm the running MLflow version and build provenance. For source deployments, verify that commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654 is present in the deployed tree. For package deployments, confirm the installed package is not MLflow 2.15.1 and that the release notes or source history include the DBFS URL validation fix. Review configuration to determine whether DBFS artifact support is enabled and whether DBFS is mounted to a local directory. Attempt only authorized validation using benign test paths: crafted DBFS URLs containing query strings, semicolon parameters, encoded traversal sequences, or references to harmless files should be rejected or normalized safely and must not return local file contents. Validate that MLflow is not running with unnecessary access to sensitive host paths such as home directories, SSH material, cloud credential files, or service configuration directories.

Typical attack path

1. Discover an MLflow service that is reachable over the network.
2. Determine that the deployment uses DBFS artifact storage or DBFS service integration mounted to a local directory.
3. Authenticate or otherwise reach an MLflow artifact retrieval, listing, or logging path that processes DBFS artifact URLs.
4. Submit a crafted DBFS URL where the path component passes validation but the query or parameter component contains traversal or a sensitive local file target.
5. Trigger MLflow to resolve the crafted URL through the local file protocol path construction logic.
6. Read the returned local file content from the MLflow server process context.
7. Extract secrets, tokens, source code, model metadata, or configuration files.
8. Use recovered credentials for follow-on access to cloud storage, Databricks/DBFS resources, source repositories, databases, or other internal services.

How to detect it

Review HTTP access logs from reverse proxies, load balancers, API gateways, and MLflow application logs for artifact-related requests involving DBFS paths with query strings, semicolon parameters, encoded traversal, or sensitive file names. Focus on requests to MLflow artifact APIs, artifact download/listing endpoints, and any endpoints that include path, artifact_uri, artifact_path, run_id, or dbfs values. Look for repeated probing of common local files such as /etc/passwd, /proc/self/environ, SSH keys, cloud credential files, MLflow configuration, and Windows system files. If available, correlate suspicious web requests with file access audit logs from the MLflow host, such as Linux auditd, eBPF/Falco telemetry, EDR file-read events, or container runtime audit logs, where the MLflow Python process reads unusual local files shortly after an artifact request. Also review MLflow experiment and run metadata for unexpected DBFS artifact URIs containing '?', ';', '../', encoded traversal, or absolute local file references. Absence of these indicators does not prove non-exploitation because successful reads may appear as normal artifact access unless detailed request and file-read telemetry is retained.

• dbfs:/
• dbfs://
• dbfs:%2f
• dbfs%3a
• ../
• ..%2f
• %2e%2e%2f
• ..%252f
• %252e%252e%252f
• artifact_uri=dbfs
• artifact_path=dbfs
• path=dbfs
• /api/2.0/mlflow-artifacts/artifacts
• /get-artifact
• /etc/passwd
• /etc/shadow
• /proc/self/environ
• /proc/1/environ
• /root/.ssh/id_rsa
• /home/
• /.ssh/id_rsa
• /.aws/credentials
• /.azure/
• /.config/gcloud/
• credentials.json
• config.json
• mlflow.db
• MLFLOW_TRACKING_URI
• DATABRICKS_TOKEN
• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AZURE_CLIENT_SECRET
• GOOGLE_APPLICATION_CREDENTIALS
• C:\\Windows\\win.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts

What your security team should do

• Prioritize patching MLflow deployments using DBFS, especially those reachable by untrusted users, shared data science teams, CI/CD systems, or the internet.
• Inventory MLflow instances and identify any running MLflow 2.15.1 or source builds that do not include commit 7791b8cdd595f21b5f179c7b17e4b5eb5cbbe654.
• Temporarily disable DBFS artifact handling or remove local DBFS mounts for MLflow until patched if immediate upgrade is not possible.
• Restrict MLflow access through authentication, authorization, VPN, private networking, and reverse-proxy allowlists.
• Review MLflow server permissions and remove access to unnecessary local files, cloud credentials, SSH keys, and service tokens.
• Search historical MLflow, reverse proxy, application, and filesystem audit logs for crafted DBFS URLs, traversal sequences, and requests for sensitive file paths.
• If suspicious access is found, rotate credentials that may have been exposed from the MLflow host, including cloud keys, Databricks tokens, database credentials, Git credentials, and SSH keys.
• Add detection rules for DBFS artifact requests containing URL query or parameter manipulation, encoded traversal, or references to sensitive local file paths.