keras-vulnerability-poc

PoC: Arbitrary Code Execution (ACE) via Custom Layer Deserialization

Description

This repository contains a Proof of Concept (PoC) model for a critical security vulnerability in the .keras model format.

Vulnerability Overview

The vulnerability allows for Arbitrary Code Execution (ACE) during the model loading process. While industry-standard static analysis tools (e.g., modelscan) focus on detecting unsafe built-in operators like Lambda, they fail to inspect the serialized logic within custom-defined layers registered via register_keras_serializable.

Key Discovery:

• Scanner Bypass: This model is flagged as "No issues found" by modelscan.
• Impact: Full system compromise (RCE) when the model is loaded in an environment where the custom class is present or provided via a side-channel (utility script).

Proof of Concept (PoC) Steps

1. Security Scan (Bypass Demonstration)

Run the following command to see the scanner failure:

modelscan -p vantage_stealth_exploit.keras

Expected Result: No issues found! 🎉

1. Execution (RCE) To trigger the payload (which creates a BYPASS.txt file in your directory), run:

import tensorflow as tf

The model contains a custom 'DataNormalization' layer with embedded system commands

model = tf.keras.models.load_model("vantage_stealth_exploit.keras") Impact This vulnerability poses a significant supply-chain risk. Attackers can distribute malicious models on public hubs that pass all automated security checks, leading to the compromise of developer environments and AI infrastructure.

Disclaimer This model is for educational and security research purposes only. It was created by Nguyen Vo Anh Khoa (Founder CR) as part of a responsible disclosure submitted to Huntr.

License Distributed under the Apache 2.0 License.