GHSA-hjqc-jx6g-rwp9: Keras Directory Traversal Vulnerability
SummaryKeras's `keras.utils.get_file()` function is vulnerable to directory traversal attacks despite implementing `filter_safe_paths()`. The vulnerability exists because `extract_archive()` uses Python's `tarfile.extractall()` method without the security-critical `filter="data"` parameter. A PATH_MAX symlink resolution bug occurs before path filtering, allowing malicious tar archives to bypass security checks and write files outside the intended extraction directory.DetailsRoot Cause Analysis**Current Keras Implementation**The Critical FlawWhile Keras attempts to filter unsafe paths using `filter_safe_paths()`, this filtering happens after the tar archive members are parsed and before actual extraction. However, the PATH_MAX symlink resolution bug occurs during extraction, not during member enumeration.**Exploitation Flow:****Archive parsing**: `filter_safe_paths()` sees symlink paths that appear safe**Extraction begins**: `extractall()` processes the filtered members**PATH_MAX bug triggers**: Symlink resolution fails due to path length limits**Security bypass**: Failed resolution causes literal path interpretation**Directory traversal**: Files written outside intended directoryTechnical DetailsThe vulnerability exploits a known issue in Python's `tarfile` module where excessively long symlink paths can cause resolution failures, leading to the symlink being treated as a literal path. This bypasses Keras's path filtering because:`filter_safe_paths()` operates on the parsed tar member informationThe PATH_MAX bug occurs during actual file system operations in `extractall()`Failed symlink resolution falls back to literal path interpretationThis allows traversal paths like `../../../../etc/passwd` to be writtenAffected Code Location**File**: `keras/src/utils/file_utils.py`  
**Function**: `extract_archive()` around line 121  
**Issue**: Missing `filter="data"` parameter in `tarfile.extractall()`Proof of ConceptEnvironment Setup**Python**: 3.8+ (tested on multiple versions)**Keras**: Standalone Keras or TensorFlow.Keras**Platform**: Linux, macOS, Windows (path handling varies)Exploitation Steps**Create malicious tar archive** with PATH_MAX symlink chain**Host archive** on accessible HTTP server**Call `keras.utils.get_file()`** with `extract=True`**Observe directory traversal** - files written outside cache directoryKey Exploit Components**Deep symlink chain**: 16+ nested symlinks with long directory names**PATH_MAX overflow**: Final symlink path exceeding system limits**Traversal payload**: Relative path traversal (`../../../target/file`)**Legitimate disguise**: Archive contains valid-looking dataset filesDemonstration Results**Vulnerable behavior:**Files extracted outside intended `cache_dir/datasets/` locationSecurity filtering bypassed completelyNo error or warning messages generated**Expected secure behavior:**Extraction blocked or confined to cache directorySecurity warnings for suspicious archive contentsImpactVulnerability Classification**Type**: Directory Traversal / Path Traversal (CWE-22)**Severity**: High**CVSS Components**: Network accessible, no authentication required, impacts confidentiality and integrityWho Is Impacted**Direct Impact:**Applications using `keras.utils.get_file()` with `extract=True`Machine learning pipelines downloading and extracting datasetsAutomated ML training systems processing external archives**Attack Scenarios:****Malicious datasets**: Attacker hosts compromised ML dataset**Supply chain**: Legitimate dataset repositories compromised**Model poisoning**: Extraction writes malicious files alongside training data**System compromise**: Configuration files, executables written to system directories**Affected Environments:**Research environments downloading public datasetsProduction ML systems with automated dataset fetchingEducational platforms using Keras for tutorialsCI/CD pipelines training models with external dataRisk Assessment**High Risk Factors:**Common usage pattern in ML workflowsNo user awareness of extraction securitySilent failure mode (no warnings)Cross-platform vulnerability**Potential Consequences:**Arbitrary file write on target systemConfiguration file tamperingCode injection via overwritten scriptsData exfiltration through planted filesSystem compromise in containerized environmentsRecommended FixImmediate MitigationReplace the vulnerable extraction code with:Long-term Solution**Add `filter="data"` parameter** to all `tarfile.extractall()` calls**Implement comprehensive path validation** before extraction**Add extraction logging** for security monitoring**Consider sandboxed extraction** for untrusted archives**Update documentation** to warn about archive security risksBackward CompatibilityThe fix maintains full backward compatibility as `filter="data"` is the recommended secure default for Python 3.12+.References[[Python tarfile security documentation](https://docs.python.org/3/library/tarfile.html#extraction-filters)](https://docs.python.org/3/library/tarfile.html#extraction-filters)[[CVE-2007-4559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4559)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4559) - Related tarfile vulnerability[[OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)](https://owasp.org/www-community/attacks/Path_Traversal)Note: Reported in Huntr as well, but didn't get response
https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4
CVSS v4.0: 8.9
CVSS v3.1: 9.8