| --- |
| license: mit |
| tags: |
| - security-research |
| - proof-of-concept |
| --- |
| |
| # ModelScan H5LambdaDetectScan Bypass via Nested Lambda Layers |
|
|
| **Security research artifact. Do not use in production.** |
|
|
| ModelScan v0.8.8's `H5LambdaDetectScan` only checks top-level layers in `model_config` JSON for Lambda layers. Keras recursively deserializes nested model structures. A Lambda layer hidden inside a nested Sequential sub-model, wrapper layer (TimeDistributed, Bidirectional), or `training_config` completely bypasses detection while executing arbitrary code on `keras.models.load_model()`. |
|
|
| ## Files |
|
|
| - `poc_nested_sequential.h5` - Lambda inside nested Sequential (bypasses scanner) |
| - `poc_timedistributed.h5` - Lambda inside TimeDistributed wrapper (bypasses scanner) |
| - `poc_bidirectional.h5` - Lambda inside Bidirectional wrapper (bypasses scanner) |
| - `poc_stealth_nlp.h5` - Lambda inside Functional model with nested Sequential (bypasses scanner) |
| - `poc_training_loss.h5` - Payload hidden in training_config loss (bypasses scanner) |
| - `poc_baseline_detected.h5` - Lambda at top level (detected by scanner, used as control) |
| - `poc_h5_nested_lambda_bypass.py` - Generator script for all variants |
| - `verify_h5_rce.py` - End-to-end RCE verification (simulates Keras 3.8.0 deserialization) |
| |
| ## Quick Verification |
| |
| ```bash |
| pip install modelscan h5py numpy |
| |
| # Scanner bypass (reports clean on malicious file): |
| modelscan --path poc_nested_sequential.h5 |
| # Output: "No issues found" |
| |
| # Scanner detects flat control: |
| modelscan --path poc_baseline_detected.h5 |
| # Output: "Unsafe operator found... Lambda" |
| |
| # Verify code execution: |
| python3 verify_h5_rce.py |
| # Output: "[RCE CONFIRMED] /tmp/h5_rce_proof exists!" |
| ``` |
| |
