MLflow Cross-Site Request Forgery Vulnerability in Signup Feature

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Signup feature of MLflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which could be used to perform unauthorized actions on behalf of the user.

Impact

Exploitation of this vulnerability could lead to unauthorized account creation and actions performed under that account.

Reproduction

To reproduce this vulnerability, log into an MLflow instance running a vulnerable version. Enable basic authentication and navigate to the signup page. An attacker could exploit the CSRF vulnerability by tricking a user into signing up, potentially using the new account to perform unauthorized actions.

Remediation

Users can disable CSRF protection by setting the 'MLFLOW_FLASK_SERVER_SECRET_KEY' environment variable to 'None'. However, this may expose the application to other CSRF-related vulnerabilities.