CVE-2024-37054-MLflow-RCE

| / || | | || | / \ \ / / | |/| || | | | | | | | | |\ \ /\ / / | | | || | | | | || || | \ V V / || |||||| ||/ // | \ / || | | \ / | | | || | | | | | |/ \ | | | | | | | | /| || | || \ ||| || / | CVE-2024-37054: MLflow リモートコード実行 PoC このリポジトリは、CVE-2024-37054 の概念実証 PoC を含んでいます。これは、MLflow...

CVE-2024-37054-MLflow-reverse-shell

도구 및 파일 파일| 목적 ---|--- generatemodel.py| 악성 model.pkl을 역방향 셸 페이로드와 함께 생성합니다 uploadmodel.py| 피클을 MLflow에 업로드하고 프로덕션으로 승격합니다 sample.csv| /predict 엔드포인트를 트리거하는 데 사용되는 CSV 파일 사용 방법 1. 악성 피클 생성 generatemodel.py를 편집하고 tun0 IP를 설정합니다: python3 generatemodel.py 2. 리스너 시작 nc -lvnp 4444 3. 악성 모델 업로드...

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

CVE-2024-37054 — MLflow pyfunc Deserialization RCE Severity...

CVE-2024-37054 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37054

CVE-2024-37054 affects MLflow and stems from a deserialization issue in mlflow.pyfunc.load_model that processes PyFunc models, allowing a maliciously crafted model to trigger arbitrary code execution when loaded or interacted with. Public details (NVD entry) indicate versions 0.9.0 and newer are ...