CVE-2023-6568 Reflected XSS via Content-Type Header in mlflow/mlflow
Attackers can execute arbitrary JavaScript in victims' browsers by injecting malicious code into the Content-Type header of POST requests to MLflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6568?
CVE-2023-6568 is a medium-severity cross-site scripting vulnerability in Lfprojects Mlflow, published on 7 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.
Weakness: CWE-79
Which versions are affected by CVE-2023-6568?
4 open source packages ship an affected version, including mlflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mlflow Bitnami | All versions | 2.9.1 |
mlflow PyPI | All versions | 2.9.0 |
mlflow PyPI | All versions | 2.9.0 |
mlflow PyPI | All versions | 2.9.1 |
Products include Lfprojects Mlflow.
How do I fix CVE-2023-6568?
Upgrade mlflow to a fixed version for your release line: 2.9.1 or 2.9.0.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-6568 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6568 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Lfprojects Mlflow
- CVE-2026-64849 MLflow Server-Side Request Forgery
- CVE-2025-15379 Command Injection in mlflow/mlflow
- CVE-2024-0520 Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
- CVE-2023-6977 Path Traversal: '\..\filename'
- CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
Sources
Also known as BIT-mlflow-2023-6568, GHSA-vwhf-3v6x-wff8, PYSEC-2023-260.