MLflow Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in MLflow version 2.15.1. This vulnerability arises when users configure and utilize the DBFS service, as it allows for arbitrary file reading by concatenating the URL directly into the file protocol. The issue occurs because only the path component of the URL is validated, leaving query parameters unchecked. Exploitation of this vulnerability requires the DBFS service to be configured and mounted to a local directory.

Impact

Exploitation of this vulnerability allows for arbitrary file reading on the system where MLflow is running.

Reproduction

The vulnerability can be reproduced by configuring the DBFS service in MLflow and mounting it to a local directory. Once this is done, a request can be made that includes a crafted file URI that exploits the path traversal flaw, such as one that includes relative path components to traverse directories and access arbitrary files.