Spoko-dev/huntr-mfv-dl4j-modelserializer-deser

Security PoC — DeepLearning4J ModelSerializer unsafe native deserialization (huntr MFV)

This is a security-research proof-of-concept for a huntr Model File Vulnerabilities (MFV) submission. It is not malware — the demonstrator payload only writes a harmless marker to /tmp (id). It is not a drop-in weapon: full RCE requires a Java-deserialization gadget on the victim's classpath (see below).

What it demonstrates

Loading malicious_model.zip with the default org.deeplearning4j.util.ModelSerializer.restoreMultiLayerNetwork(File) API passes the attacker-controlled preprocessor.bin zip entry into new ObjectInputStream(...).readObject() with no ObjectInputFilter — a CWE-502 deserialization sink. The entire object graph is deserialized (and any gadget's readObject executes) before the (DataSetPreProcessor) cast is applied.

Honest scope note

Reachability of the sink and code execution during load are proven empirically. Per standard Java-deserialization scoring, full RCE is gadget-gated: the demonstrator Pwn.java stands in for a victim-classpath gadget. On the bare deeplearning4j-core classpath no public chain fires (commons-collections4-4.1 is hardened); real deployments (Spring-Boot services, notebooks) routinely bundle a usable gadget.

Files

• malicious_model.zip — the PoC model (configuration.json + coefficients.bin + malicious preprocessor.bin).
• LoadOnly.java — loads the saved zip via the default API and shows execution.
• MakeAndRun.java — builds + loads. Pwn.java — demonstrator gadget. benign_configuration.json — real-model config reference. pom.xml — exact vulnerable dependency set (DL4J/ND4J 1.0.0-M2.1).

Reproduce (needs JDK 17 + Maven)

mvn -q dependency:copy-dependencies -DoutputDirectory=libs   # pull DL4J/ND4J jars
./run.sh                                                     # build PoC + load -> writes /tmp/huntr_dl4j_pwned

Fix

Wrap the preprocessor.bin stream in a JEP-290 ObjectInputFilter allow-listing only DataSetPreProcessor implementors, or drop Java native serialization for that entry.