dl4j-getobjectfromfile-deser-poc-DO-NOT-USE

WARNING: SECURITY RESEARCH - PROOF OF CONCEPT ONLY

This repository contains intentionally vulnerable/malicious demonstration code for a responsibly-disclosed vulnerability (DL4J ModelSerializer getObjectFromFile() unfiltered Java deserialization, CWE-502).

DO NOT deploy, run in production, or use outside of an isolated, disposable research environment (e.g. a throwaway VM or container).

This PoC only writes a benign canary file to prove code execution. It does not exfiltrate data, open network connections, or execute system commands.

---

Vulnerability Summary

Eclipse Deeplearning4j ModelSerializer.getObjectFromFile() (line 869-878 in ModelSerializer.java) reads a ZIP entry named objects/<key> from a DL4J .zip model file and passes its bytes directly to ObjectInputStream.readObject() with no ObjectInputFilter, no class allow-list, and no validation.

This is a textbook CWE-502: Deserialization of Untrusted Data sink.

Unlike the previously-disclosed preprocessor.bin vector (published by researcher hacnho at hacnho/model-format-dl4j-java-deser-rce), this sink is reached via the explicit getObjectFromFile() API, not the default restoreMultiLayerNetwork() load path. It is an independent, unfixed instance of the same root cause.

Prior disclosure (hacnho): preprocessor.bin in restoreMultiLayerNetwork / restoreComputationGraph — covered by hacnho's PoC, no CVE. This report: objects/<key> in getObjectFromFile() — new, independent, not covered by hacnho's PoC.

Status: Unfixed — no ObjectInputFilter committed on master.

---

Files

---

Reproduction

Requirements

• Java 17+ (tested on OpenJDK 21)
• DL4J 1.0.0-M2.1 jars on the classpath: deeplearning4j-core, deeplearning4j-nn, nd4j-api, nd4j-native, plus transitive dependencies (Jackson, SLF4J)

Steps

# 1. Compile the Evil gadget and run harness
javac -cp deeplearning4j-core-1.0.0-M2.1.jar:deeplearning4j-nn-1.0.0-M2.1.jar:nd4j-api-1.0.0-M2.1.jar:nd4j-native-1.0.0-M2.1.jar \
  EvilGadget.java RunPoc1.java

# 2. Run the PoC
java -cp .:deeplearning4j-core-1.0.0-M2.1.jar:deeplearning4j-nn-1.0.0-M2.1.jar:nd4j-api-1.0.0-M2.1.jar:nd4j-native-1.0.0-M2.1.jar \
  RunPoc1

# 3. Verify the canary
cat /tmp/dl4j_poc1_confirmed.txt

Expected Output

[POC] Canary written: /tmp/dl4j_poc1_confirmed.txt -> POC1_OK: getObjectFromFile-deser-triggered-at-<timestamp>

###########################################################
#  POC 1 SUCCESS: getObjectFromFile() DESERIALIZATION RCE  #
###########################################################
  Canary file: /tmp/dl4j_poc1_confirmed.txt
  Content:     POC1_OK: getObjectFromFile-deser-triggered-at-<timestamp>
  Explanation: ModelSerializer.getObjectFromFile() called
  ObjectInputStream.readObject() on objects/exploit_key entry
  WITHOUT ObjectInputFilter -> gadget readObject() executed.
  Sink: ModelSerializer.java L876-877 (objects/<key> sink)
  NOT covered by hacnho PoC.
###########################################################

The canary file proves that attacker-controlled serialized data in objects/<key> is deserialized without filtering.

---

Gadget Design

EvilGadget is a plain Serializable class with a single readObject() override that performs only:

1. in.defaultReadObject() — standard deserialization
2. FileWriter("/tmp/dl4j_poc1_confirmed.txt") — writes a benign marker
3. System.err.println(...) — console notification

It uses none of the following:

• Runtime.exec() / ProcessBuilder
• Socket / URL / HttpURLConnection
• System.getenv() / System.getProperty()
• Reflection / Method.invoke()
• InvokerTransformer / TemplatesImpl / any third-party gadget class

In a real attack, this class would be replaced by a ysoserial gadget chain targeting a library on the victim's classpath (e.g. commons-collections, c3p0, Spring AOP). The PoC demonstrates the deserialization primitive — the unfiltered ObjectInputStream.readObject() — not a full weaponized chain.

---

References

• API docs: ModelSerializer.getObjectFromFile(File, String)
• Source: deeplearning4j-nn/src/main/java/org/deeplearning4j/util/ModelSerializer.java#L869-L878
• CWE-502: Deserialization of Untrusted Data (https://cwe.mitre.org/data/definitions/502.html)
• JEP 290: Filter Incoming Serialization Data (https://openjdk.org/jeps/290)
• Prior disclosure: hacnho (hacnho/model-format-dl4j-java-deser-rce) — covers preprocessor.bin only