huntr-mfv-dl4j-jackson-idclass

Security PoC — DeepLearning4J configuration.json Jackson Id.CLASS class-load (huntr MFV)

Security-research PoC for a huntr MFV submission. Not malware — the demonstrator only writes harmless /tmp markers, and is a stand-in for a victim-classpath gadget (full RCE is gadget-gated).

Loading a DL4J model via the default ModelSerializer.restoreMultiLayerNetwork(File) deserializes configuration.json with Jackson; seven per-layer interfaces use @JsonTypeInfo(use=Id.CLASS) with LaissezFaireSubTypeValidator, so any "@class" value drives Class.forName(name, /*initialize=*/true) — the named class's static initializer runs before the subtype check (CWE-502/CWE-470). Full no-arg construction follows for any class assignable to one of the seven interfaces, and the load then completes silently.

Environment

DL4J/ND4J 1.0.0-M2.1, JDK 17. Build the classpath from libs/ (via mvn dependency:copy-dependencies on the included pom.xml).

Reproduce

./run.sh
#  [A] activationFn @class=poc.Evil          -> poc.Evil <clinit> RAN
#  [B] activationFn @class=poc.EvilActivation -> <clinit> + constructor RAN, restore returned network=true (silent)
#  /tmp markers: huntr_r2_jackson_clinit , huntr_r2_jackson_ctor

Files: poc/CraftAndRestore.java (craft+load), poc/Probe.java (T1–T4 probe), poc/{Evil,EvilActivation}.java (demonstrators), poc/GenModel.java, pom.xml.