modelscan-h5-bypass-poc

ModelScan H5 Scanner Bypass PoC

Vulnerability

ModelScan v0.8.8's H5LambdaDetectScan scanner only checks top-level layers in the H5 model config for class_name == "Lambda". Lambda layers nested inside sub-models or wrapper layers are not detected.

Vulnerable Code

modelscan/scanners/h5/scan.py lines 105-130:

def _get_keras_h5_operator_names(self, model: Model) -> Optional[List[Any]]:
    with h5py.File(model.get_stream()) as model_hdf5:
        model_config = json.loads(model_hdf5.attrs.get("model_config", {}))
        layers = model_config.get("config", {}).get("layers", {})
        lambda_layers = []
        for layer in layers:
            if layer.get("class_name", {}) == "Lambda":  # Only top-level!
                lambda_layers.append(...)

Root Cause

The scanner iterates model_config["config"]["layers"] at the top level only. It does not:

1. Recursively check layers inside nested Functional/Sequential sub-models
2. Check the layer field inside wrapper layers (TimeDistributed, Bidirectional)

Bypass Techniques

1. Nested Functional Sub-Model (nested_model_h5_bypass.h5)

Lambda is placed inside a Functional sub-model:

• Scanner sees: [Dense, Functional] -> No Lambda detected
• Actual: Functional.config.layers contains [InputLayer, Lambda]

2. TimeDistributed Wrapper (wrapper_layer_h5_bypass.h5)

Lambda is wrapped inside a TimeDistributed layer:

• Scanner sees: [Dense, TimeDistributed] -> No Lambda detected
• Actual: TimeDistributed.config.layer is a Lambda

Code Execution Chain

When loading with tf.keras.models.load_model('model.h5', safe_mode=False):

1. load_model() reads model_config from HDF5 attribute
2. model_from_config() processes layers recursively
3. Functional.from_config() calls process_layer() for each nested layer
4. Lambda.from_config() calls python_utils.func_load()
5. func_load() does: base64.decode() -> marshal.loads() -> types.FunctionType() -> ACE

Scan Results

$ modelscan -p nested_model_h5_bypass.h5
No issues found!

$ modelscan -p wrapper_layer_h5_bypass.h5
No issues found!

$ modelscan -p normal_lambda.h5  # (top-level Lambda for comparison)
Total Issues: 1 (MEDIUM: Use of unsafe operator 'Lambda')

Impact

An attacker can craft a malicious .h5 model file that:

1. Passes ModelScan security scanning with 0 issues
2. Executes arbitrary code when loaded by the victim
3. Uses the exact same code execution chain as detected Lambda layers

Fix

Replace the top-level-only layer check with recursive traversal of all layers, including nested models and wrapper layers.