huntr-mfv-dl4j-normalizer-reflection

Security PoC — DeepLearning4J NormalizerSerializer unsafe reflection (huntr MFV)

Security-research PoC for a huntr MFV submission. Not malware — the demonstrator only writes harmless /tmp markers, and is a stand-in for a victim-classpath gadget (full RCE is gadget-gated).

malicious_model.zip carries a normalizer.bin with a CUSTOM header naming an attacker class. Loading it via the default ModelSerializer.restoreMultiLayerNetworkAndNormalizer(File,true) calls ND4JClassLoading.loadClassByName(name) = Class.forName(name, /*initialize=*/true) (static initializer runs) then Class.newInstance() (no-arg constructor runs) — both before the type is checked (CWE-470 unsafe reflection).

Environment

DL4J/ND4J 1.0.0-M2.1, JDK 17. Build the classpath from libs/ (via mvn dependency:copy-dependencies on the included pom.xml).

Reproduce

# compile the demonstrator + craft/load driver, then:
java -cp "out:libs/*" CraftAndLoad
#  [EvilNormalizerStrategy] WROTE marker /tmp/huntr_r2_normalizer_staticinit
#  [EvilNormalizerStrategy] WROTE marker /tmp/huntr_r2_normalizer_ctor
#  restore threw ClassCastException (expected, AFTER the sinks fire)

Both the static initializer and the no-arg constructor execute during the load. Files: src/CraftAndLoad.java (craft+load), src/EvilNormalizerStrategy.java (demonstrator), pom.xml (exact vulnerable deps).