CVE-2024-37060: 
NixOS vulnerability analysis and mitigation

A deserialization vulnerability (CVE-2024-37060) affects the MLflow platform versions 1.27.0 and newer. The vulnerability enables a maliciously crafted Recipe to execute arbitrary code on an end user's system when run (NVD, HiddenLayer).

The vulnerability exists within the recipes/cards/init.py file in the BaseCard class's static load method. The vulnerability occurs when the BaseCard.load() function deserializes untrusted data using pickle.load() without proper validation. The issue is tracked as CWE-502 (Deserialization of Untrusted Data) and has been assigned a CVSS v3.1 score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (HiddenLayer).

When exploited, this vulnerability allows attackers to execute arbitrary code on the end user's system when a malicious Recipe is run. The high CVSS score indicates that successful exploitation can lead to complete compromise of the system's confidentiality, integrity, and availability (HiddenLayer).

An attacker can exploit this vulnerability by creating an MLProject Recipe containing a malicious pickle file (e.g., pickle.pkl) and a Python script that calls BaseCard.load(pickle.pkl). When the victim runs the project, the pickle file is deserialized, leading to the execution of arbitrary code on their machine (HiddenLayer).