Views
No views yet
ModelSerializer unsafe native deserialization (huntr MFV)/tmp (id). It is not a drop-in weapon: full RCE requires a Java-deserialization gadget on the victim's classpath (see below).malicious_model.zip with the default org.deeplearning4j.util.ModelSerializer.restoreMultiLayerNetwork(File) API passes the attacker-controlled preprocessor.bin zip entry into new ObjectInputStream(...).readObject() with no ObjectInputFilter — a CWE-502 deserialization sink. The entire object graph is deserialized (and any gadget's readObject executes) before the (DataSetPreProcessor) cast is applied.Pwn.java stands in for a victim-classpath gadget. On the bare deeplearning4j-core classpath no public chain fires (commons-collections4-4.1 is hardened); real deployments (Spring-Boot services, notebooks) routinely bundle a usable gadget.malicious_model.zip — the PoC model (configuration.json + coefficients.bin + malicious preprocessor.bin).LoadOnly.java — loads the saved zip via the default API and shows execution.MakeAndRun.java — builds + loads. Pwn.java — demonstrator gadget. benign_configuration.json — real-model config reference. pom.xml — exact vulnerable dependency set (DL4J/ND4J 1.0.0-M2.1).1mvn -q dependency:copy-dependencies -DoutputDirectory=libs # pull DL4J/ND4J jars
2./run.sh # build PoC + load -> writes /tmp/huntr_dl4j_pwnedpreprocessor.bin stream in a JEP-290 ObjectInputFilter allow-listing only DataSetPreProcessor implementors, or drop Java native serialization for that entry.