YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: Unsafe Java deserialization in Deeplearning4j ModelSerializer (RCE)
model.zip is a Deeplearning4j model archive whose only entry is a malicious preprocessor.bin.
org.deeplearning4j.util.ModelSerializer deserializes that entry with a raw ObjectInputStream.readObject()
(no ObjectInputFilter) on the default load path, so loading this file runs attacker-controlled Java
deserialization → remote code execution when a gadget library is on the classpath.
Reproduce
import org.deeplearning4j.util.ModelSerializer;
import java.io.File;
public class Load {
public static void main(String[] a) throws Exception {
// documented public API — the "download a pretrained model and load it" workflow
ModelSerializer.restoreMultiLayerNetwork(new File("model.zip"));
}
}
With a deserialization gadget on the classpath (e.g. commons-collections:3.2.1, which every
Spark/Hadoop-backed DL4J stack pulls transitively) this executes an OS command
(id, writing /tmp/DL4J_PWNED_ID) before the loader throws on the type cast.
On a pristine deeplearning4j-core + nd4j classpath the same load path still deserializes
untrusted bytes (CWE-502) — reachable, unauthenticated, no user interaction beyond loading the model.
Root cause: deeplearning4j-nn util/ModelSerializer.java, preprocessor.bin block sits outside the
loadUpdater guard; twin sinks in the ComputationGraph and normalizer paths. No ObjectInputFilter anywhere.