https://wearethebug.dev/tags/cve-2024-37054/Recent content on WE ARE THE BUGTradecraften-usSun, 17 May 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-smarthire/Sun, 17 May 2026 00:00:00 +0000https://wearethebug.dev/posts/htb-smarthire/SmartHire is a Medium-rated Linux machine that chains MLflow unsafe deserialization (CVE-2024-37054) to pivot from an unauthenticated web portal into a foothold as the svcweb user. Root falls to a Python .pth injection via a group-writable plugin directory, abused through a passwordless sudo misconfiguration to spawn a SUID shell and fully compromise the box.