Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Server-Side Request Forgery (SSRF) in the MLflow tracking server's webhook feature. The root cause is a Time-of-Check to Time-of-Use (TOCTOU) flaw. The _validate_webhook_url function checks the webhook's URL at registration time, ensuring it resolves to a public IP address. However, when the webhook is tested or triggered, the requests library, configured by _create_webhook_session, follows HTTP redirects. An attacker can register a webhook with a URL on a server they control, which passes the initial validation. This server then returns an HTTP redirect (e.g., 302) to an internal IP address, such as a cloud metadata service (169.254.169.254) or a loopback address (127.0.0.1). The _send_webhook_request function, using the session from _create_webhook_session, follows this redirect without re-validating the new destination. The response from the internal service is then returned to the attacker through the /api/2.0/mlflow/webhooks/{id}/test endpoint, resulting in a full-read SSRF. The patch addresses this by introducing a custom SSRFProtectedHTTPAdapter which validates the peer IP of every connection immediately after it's established, thus preventing the exploit by checking the IP of the redirected destination.
mlflow.webhooks.delivery._create_webhook_sessionmlflow/webhooks/delivery.py
mlflow.webhooks.delivery._send_webhook_requestmlflow/webhooks/delivery.py
mlflow.utils.validation._validate_webhook_urlmlflow/utils/validation.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | < 3.15.0 | 3.15.0 |