ClearML-Vulnerability-Blurry-

This is about exploiting insecure pickle files. It was disclosed that an attacker could create a pickle file which contains an arbitrary code and upload it as an artifact to a project via the API.

Anytime a user calls the get method within the Artifact class to download and load a file into memory, the pickle file is deserialized on their system, running any arbitrary code it contains.

1. Find the domains
2. Save the subdomains in your hosts file
3. Create a project on ClearML
4. Setup clearml using the provided steps while creating a new experiment
5. Run 'python exploitCML.py' (user.txt)
6. Upload pytorch file to ClearML server
7. Setup a listener get connection (root.txt)