MLFlow has emerged because the most-vulnerable open supply machine studying framework with 4 extremely vital (CVSS 10) vulnerabilities reported inside 50 days, based on a Shield AI report.
Shield AI’s AI/ML bug bounty program, hunter AI, found these vulnerabilities inside the MLFlow platform, which may permit Distant Code Execution (RCE), Arbitrary File Overwrite, and Native File Embrace. This might probably result in system takeover, delicate info loss, denial of service, and destruction of knowledge, based on Shield AI.
“The report consists of 4 vital flaws present in MLflow, the favored open-source platform utilized by practitioners to handle numerous phases of a machine studying mission, together with experimentation, reproducibility, deployment, and a central mannequin registry,” Shield AI mentioned.
With lesser sought alternate options like Amazon Sagemaker, Neptune, Comet, and KuberFlow, MLFlow is a broadly in style machine studying lifecycle platform with greater than 10 million month-to-month downloads and a wealthy person neighborhood together with Fb, Databricks, Microsoft, Accenture, and Reserving.com.
hunter AI traced RCE heavy vulnerabilities
Tracked as CVE-2024-0520, the newest vulnerability revealed by hunter AI is a path traversal flaw within the code used to tug down distant knowledge storage. The flaw can be utilized for a distant code execution (RCE) assault by fooling a person into utilizing a malicious distant knowledge supply that may execute instructions on the person’s behalf.
The affected code is native to the MLFlow.knowledge module listed inside the PyPi registry, which is used to assist preserve a file of mannequin coaching and analysis datasets. The bug, which was mounted within the newest launch of MLFLow, has had no recognized energetic exploitations.
