romandaripper/synalinks-json-deser-rce-mfv-poc

synalinks — JSON program deserialization → RCE on load (MFV PoC)

Security research PoC for a Model File Vulnerability in SynaLinks/synalinks. Disclosed via huntr (Model File Vulnerability track). Credit: Cyfra Tech Solutions (Roman Arce Brán).

Defanged, benign payload. Published for coordinated disclosure only. Do not run untrusted synalinks programs.

Summary

synalinks.Program.load() / synalinks.programs.program_from_json() reconstruct a functional graph from a .json program file. During deserialization, _retrieve_class_or_fn (synalinks/src/saving/serialization_lib.py) calls importlib.import_module() on an attacker-controlled module name and returns a resolved FunctionType directly — bypassing both the from_config gate and safe_mode. The resolved callable is then invoked during graph reconstruction (functional.py:333) with attacker-controlled args/kwargs, giving arbitrary code execution at load time.

This is CWE-502, the same class as Keras CVE-2025-1550, but a distinct 0-day in synalinks' own fork, which never absorbed the Keras 3.9 module-allowlist fix. There is no module allowlist in synalinks HEAD.

Impact

Unauthenticated RCE on load of an untrusted synalinks program .json. No further interaction required. CVSS ~9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Validated 5/5 deterministic in an isolated lab.

Files

• malicious_program.json — the malicious synalinks program (benign payload: writes a proof file with id output + RCE_ON_LOAD marker; no network, no persistence, no destructive action).
• gen_malicious_program.py — generator that produces malicious_program.json.

Reproduce (isolated lab only)

git clone https://github.com/SynaLinks/synalinks && cd synalinks   # HEAD 2cbb7e29, v0.9.008
python -m venv .venv && . .venv/bin/activate && pip install -e .    # Python >=3.11
python gen_malicious_program.py /tmp/synalinks_poc_proof.txt malicious_program.json
# Loading the file is what triggers RCE:
python -c "import synalinks; synalinks.Program.load('malicious_program.json')"
# => proof file written during load; uid=... \n RCE_ON_LOAD

The AttributeError raised after the payload is posterior to code execution — the subprocess already ran at functional.py:333.

Remediation

Port the Keras 3.9 fix: enforce a module/symbol allowlist in _retrieve_class_or_fn before importlib.import_module, and never return arbitrary callables resolved from untrusted config regardless of safe_mode.