GHSA-2wqp-q3c6-ccj5: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

Summary

MLflow's tracking server exposes POST /ajax-api/3.0/mlflow/scorer/invoke without authentication, and its handler reflectively instantiates an attacker-named class from attacker-supplied JSON with unconstrained constructor kwargs. With the optional trulens and trulens-providers-litellm packages installed, an unauthenticated attacker can make the server send an outbound HTTP request to an arbitrary host carrying attacker-controlled headers.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumGHSA-vqqp-x5qm-5qp4: FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization serverSimilar attack · GitHub Advisory Database
• MediumNew Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain AttackSimilar attack · Socket Blog
• LowYou gave your AI agent access, but who is giving it orders?Similar attack · BleepingComputer
• MediumCritical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token BalancesSimilar attack · The Hacker News
• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSimilar attack · TechCrunch (Security)