CVE-2024-37054-MLflow-RCE

| / || | | || | / \ \ / / | |/| || | | | | | | | | |\ \ /\ / / | | | || | | | | || || | \ V V / || |||||| ||/ // | \ / || | | \ / | | | || | | | | | |/ \ | | | | | | | | /| || | || \ ||| || / | CVE-2024-37054: PoC удаленного выполнения кода в MLflow Этот репозиторий содержит Proof of...

CVE-2024-37054-MLflow-reverse-shell

Инструменты и файлы Файл| Назначение ---|--- generatemodel.py| Генерирует вредоносный model.pkl с полезной нагрузкой reverse shell uploadmodel.py| Загружает pickle в MLflow и продвигает его в Production sample.csv| CSV-файл, используемый для вызова конечной точки /predict Использование 1...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

CVE-2024-37054 — MLflow pyfunc Deserialization RCE Severity...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

CVE-2024-37054 affects MLflow and stems from a deserialization issue in mlflow.pyfunc.load_model that processes PyFunc models, allowing a maliciously crafted model to trigger arbitrary code execution when loaded or interacted with. Public details (NVD entry) indicate versions 0.9.0 and newer are ...