PoC: TensorFlow SavedModel arbitrary file write that bypasses ModelScan
Security research proof-of-concept submitted via the huntr Model File
Vulnerability program (target: TensorFlow SavedModel). The model in this repo is
non-destructive: when loaded and invoked it writes a single harmless marker
file to /tmp/MODELSCAN_BYPASS_POC.txt. It performs no other action.
What this demonstrates
saved_model/ is an ordinary-looking TensorFlow SavedModel (a x -> x*2 module).
Its serving signature also contains a PrintV2 op with
output_stream="file:///tmp/MODELSCAN_BYPASS_POC.txt". When the model is loaded
and called, that op appends attacker-controlled content to an attacker-controlled
absolute path — an arbitrary file-write primitive. Pointed at ~/.bashrc,
~/.ssh/authorized_keys, or a crontab, it is a remote-code-execution primitive.
The point of the PoC is that ProtectAI ModelScan reports this model as clean:
$ modelscan -p saved_model
No issues found! 🎉
ModelScan's TensorFlow denylist contains only ReadFile and WriteFile
(modelscan/settings.py). PrintV2 (and SaveV2, MatchingFiles, the dataset
reader ops, …) perform equivalent filesystem I/O but are not denylisted, so they
pass. ModelScan inspects operator names only — never the output_stream
attribute — so the destination path is invisible to it.
Reproduce
bash
1pip install tensorflow-cpu
2python3 poc.py # builds + loads + invokes, prints the written file; runs ModelScan logic3# or scan this repo's model directly:4modelscan -p saved_model # -> "No issues found!"5ls -l /tmp/MODELSCAN_BYPASS_POC.txt # the model wrote this on invocation
Files
saved_model/ — the malicious (but non-destructive) SavedModel.
poc.py — builds the model, triggers the write, and replicates ModelScan's verdict.
Impact & fix
Arbitrary file write → code execution, undetected by the scanner that gates model
submission/consumption. Fix: allowlist pure ops (or expand the denylist to all
filesystem/IO ops) and inspect op attributes such as PrintV2.output_stream.
Tested: TensorFlow 2.21.0, ModelScan main @ 61fcec9.
