Executive Summary

This vulnerability is a command injection issue in mlflow/mlflow when serving a model with the option `enable_mlserver=True`. The problem arises because the `model_uri` is directly embedded into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters like `$()` or backticks, it can lead to command substitution, allowing an attacker to execute arbitrary commands.

This means that an attacker can inject malicious commands through the `model_uri` parameter, potentially gaining unauthorized control over the system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including privilege escalation. If a higher-privileged service serves models from a directory writable by lower-privileged users, an attacker can exploit this flaw to execute commands with elevated privileges.

The CVSS score of 9.6 indicates a critical severity, meaning it can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, avoid serving models with the `enable_mlserver=True` option until a fix is applied.

Ensure that the `model_uri` does not contain shell metacharacters such as `$()` or backticks to prevent command injection.

Restrict write permissions on directories from which models are served, especially preventing lower-privileged users from writing to directories used by higher-privileged services.

Monitor for updates or patches from the mlflow/mlflow project and apply them promptly.

Useful 0 Not Useful 0