You can deploy this model and start earning money today!

optimus-fulcria/
modelscan-h5-bypass-poc

Name: modelscan-h5-bypass-poc
Availability: InStock

Views

No views yet

ModelScan H5 Scanner Bypass PoC

Vulnerability

ModelScan v0.8.8's H5LambdaDetectScan scanner only checks top-level layers in the H5 model config for class_name == "Lambda". Lambda layers nested inside sub-models or wrapper layers are not detected.

Vulnerable Code

modelscan/scanners/h5/scan.py lines 105-130:

python

def _get_keras_h5_operator_names(self, model: Model) -> Optional[List[Any]]:
    with h5py.File(model.get_stream()) as model_hdf5:
        model_config = json.loads(model_hdf5.attrs.get("model_config", {}))
        layers = model_config.get("config", {}).get("layers", {})
        lambda_layers = []
        for layer in layers:
            if layer.get("class_name", {}) == "Lambda":  # Only top-level!
                lambda_layers.append(...)

Root Cause

The scanner iterates model_config["config"]["layers"] at the top level only. It does not:

Recursively check layers inside nested Functional/Sequential sub-models
Check the layer field inside wrapper layers (TimeDistributed, Bidirectional)

Bypass Techniques

1. Nested Functional Sub-Model (`nested_model_h5_bypass.h5`)

Lambda is placed inside a Functional sub-model:

Scanner sees: [Dense, Functional] -> No Lambda detected
Actual: Functional.config.layers contains [InputLayer, Lambda]

2. TimeDistributed Wrapper (`wrapper_layer_h5_bypass.h5`)

Lambda is wrapped inside a TimeDistributed layer:

Scanner sees: [Dense, TimeDistributed] -> No Lambda detected
Actual: TimeDistributed.config.layer is a Lambda

Code Execution Chain

When loading with tf.keras.models.load_model('model.h5', safe_mode=False):

load_model() reads model_config from HDF5 attribute
model_from_config() processes layers recursively
Functional.from_config() calls process_layer() for each nested layer
Lambda.from_config() calls python_utils.func_load()
func_load() does: base64.decode() -> marshal.loads() -> types.FunctionType() -> ACE

Scan Results

$ modelscan -p nested_model_h5_bypass.h5
No issues found!

$ modelscan -p wrapper_layer_h5_bypass.h5
No issues found!

$ modelscan -p normal_lambda.h5  # (top-level Lambda for comparison)
Total Issues: 1 (MEDIUM: Use of unsafe operator 'Lambda')

Impact

An attacker can craft a malicious .h5 model file that:

Passes ModelScan security scanning with 0 issues
Executes arbitrary code when loaded by the victim
Uses the exact same code execution chain as detected Lambda layers

Fix

Replace the top-level-only layer check with recursive traversal of all layers, including nested models and wrapper layers.

optimus-fulcria/modelscan-h5-bypass-poc