Listen to this Post
The vulnerability exists in `keras.utils.get_file()` when extracting tar archives. The function uses `tarfile.extractall()` without the security-critical `filter=”data”` parameter. While Keras attempts to filter unsafe paths with filter_safe_paths(), this check occurs during archive member enumeration, not during the actual filesystem extraction. A known bug in Python’s `tarfile` module can be triggered by a crafted archive containing a chain of symlinks with very long pathnames. During extraction, when the system’s `PATH_MAX` limit is exceeded during symlink resolution, the operation fails and the symlink’s path is treated literally. This allows a maliciously crafted symlink pointing to a traversal path (e.g., ../../../../etc/passwd) to bypass the earlier filtering and write files outside the intended cache directory, leading to arbitrary file write.
Platform: Keras (Standalone/TensorFlow)
Version: Affected versions
Vulnerability : Directory Traversal
Severity: Critical
date: Reported 2024
Prediction: Patch Q2 2024
What Undercode Say:
Simulating the vulnerable extraction
python3 -c "import tarfile; t=tarfile.open('mal.tar.gz'); t.extractall()"
Vulnerable Keras code snippet keras/src/utils/file_utils.py ~line 121 archive.extractall(path, members=filter_safe_paths(archive)) Missing filter="data"
PoC: Create malicious tar with long symlink chain python3 create_poc_archive.py
Exploit:
- Attacker creates tar archive with deep symlink chain exceeding PATH_MAX.
2. Final symlink uses `../../../` traversal path.
3. Victim uses `keras.utils.get_file(extract=True)` on the archive.
- Symlink resolution fails, path interpreted literally, writing file outside cache.
Protection from this CVE
Apply patch adding `filter=”data”` to tarfile.extractall(). Use: archive.extractall(path, members=filter_safe_paths(archive), filter="data").
Impact:
Arbitrary file write, system compromise, data breach, ML supply chain attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
