Remote Code Execution in MLflow DSPy Flavor

Executive Summary

This vulnerability affects MLflow's dspy flavor versions 2.0 and above. The security control MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False is only enforced when the model_path ends in .pkl. This allows attackers to bypass the control by using crafted MLmodel artifacts, potentially leading to arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if MLflow's dspy flavor is used with model paths not ending in .pkl. Inspect MLmodel artifacts for dspy configurations. Verify if MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False is bypassed by testing deserialization of non-.pkl files.

Useful 0 Not Useful 0

Impact Analysis

If you use MLflow's dspy flavor with versions >= 2.0, an attacker could exploit this to execute arbitrary code on your system. This could lead to data breaches, unauthorized access, or system compromise if malicious MLmodel artifacts are processed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update MLflow to a version where the security control is applied regardless of file extension. Avoid using .pkl files in MLmodel artifacts. Review and validate all MLmodel artifacts for suspicious content.

Useful 0 Not Useful 0