Don't let hackers compromise your machine learning platform! Analysis of security vulnerabilities in ModelDB and MLflow

Recently, security vulnerabilities have been disclosed in ModelDB and MLflow. If successfully exploited, attackers can steal confidential data such as machine learning models from the systems, and even take control of the entire machine learning system.

The application of machine learning (ML) has grown exponentially over the past few years, being used to analyze and interpret patterns and structures in data to achieve learning, reasoning, and decision-making actions without human interaction. It has provided support for many areas of artificial intelligence, including sentiment analysis, image classification, facial detection, threat intelligence, and more.

As more and more machine learning models are developed, cyberattacks targeting machine learning models are also emerging one after another. More components involved in machine learning training, deployment, and management are drawing hackers' attention, with various vulnerabilities and risks being exposed.

The increasing threat prompted OWASP to release the Top 10 Machine Learning Vulnerabilities list, where ML05-2023 Model Theft is ranked fifth.

01

—

ModelDB Security Vulnerability (CVE-2023-6023)

▌Vulnerability Description

ModelDB is an open-source system for machine learning model versioning, metadata, and experiment management. It allows versioning of machine learning models, including their constituent code, data, configuration, and environment, and tracks ML metadata throughout the model lifecycle. ModelDB is affected by the CVE-2023-6023 security vulnerability, which stems from a Local File Inclusion (LFI) vulnerability in the artifact_path URL parameter. An attacker can exploit this vulnerability to read any file on the ModelDB server filesystem.

▌Vulnerability Reproduction

Vulnerability Lab Environment Setup:

• modeldb: https://github.com/VertaAI/modeldb

• Start directly using docker, docker-compose -f docker-compose-all.yaml up

Vulnerability POC:

▌Root Cause

The artifact_path parameter is not validated.

▌Affected Scope

<= modeldb 2.0.4

▌Security validation rules

On December 12, the attack simulation for this vulnerability was added to the Cyberscene Security Metric Validation Platform. You can search for the keywords "ModelDB" or "CVE-2023-6023" on the platform to obtain the relevant attack simulation validation actions, thereby verifying whether your security defense system can effectively respond to this vulnerability. The platform ensures your validation process is secure and harmless in an industry-unique manner.

02

—

MLflow Security Vulnerability (CVE-2023-6015)

▌Vulnerability Description

MLflow is an open-source machine learning platform that covers the entire lifecycle of machine learning (from data preparation to model training and final deployment). It provides a set of tools to help data scientists and engineers track experiments, reproduce results, deploy models, and share code. MLflow was developed and open-sourced by Databricks and has now become one of the most popular platforms in the machine learning field. MLflow is affected by the CVE-2023-6015 security vulnerability, which stems from allowing attackers to access arbitrary files in the operating system via path traversal.

▌Penetration (Bypass) Ideas

• If the path starting with C: on Windows is not clear, generally on Windows, paths starting with C: can have the drive letter and colon removed from the beginning.

• For example, the path C:../.ssh/id_rsa will be converted to ../.ssh/id_rsa. This way we can break out of the root directory to the first level.

• One of the best ways to reach the root mlflow directory is the /api/2.0/mlflow-artifacts/artifacts path.

• We assume the directory root is C://Users/User/mlflowui, then the query path /api/2.0/mlflow-artifacts/artifacts allows us to reach the root C://Users/User/mlflowui directory and retrieve files from C://Users/User, which can contain SSH keys.

▌Attack Process

The file generated by the attack will be stored in C://Users/test/.ssh/id_rsa

1. Add secret text into C://Users/test/.ssh/id_rsa

2. Create mlfloui folder and run mlflow from the current directory

3. Run mlflow uiin C://Users/test/mlflowui

4. Write content curl command

   curl -X PUT –data-binary test “http://127.0.0.1:5000/api/2.0/mlflow-artifacts/artifacts/C:../.ssh/id_rsa”

5. Read content curl command

   curl -vv “http://127.0.0.1:5000/api/2.0/mlflow-artifacts/artifacts/C:../.ssh/id_rsa”

▌Vulnerability Remediation

Upgrade version to mlflow – 2.8.1

▌Vulnerability PoC

Use PUT to send packet and successfully write to the file

File id_rsa successfully created in the docker file

Combined with the read vulnerability, the file written by PUT is read correctly.

▌Security validation rules

On December 12, the attack simulation for this vulnerability was added to the Cyberscene Security Metric Validation Platform. You can search for the keywords "MLflow" or "CVE-2023-6015" on the platform to obtain the relevant attack simulation validation actions, thereby verifying whether your security defense system can effectively respond to this vulnerability. The platform ensures your validation process is secure and harmless in an industry-unique manner.