Modelpublic

celvexgroup/modelaudit-keras-indexlookup-vocab-poc

sourceHugging Faceupdated 2mo agoView on Hugging Face

0likes31downloads

Model Card

PoC - modelaudit CVE-2025-12058 detector is StringLookup-only, misses IndexLookup siblings (BL-0112)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.

—Scanner: modelaudit==0.2.49 (keraszipscanner.py). Format: Keras Native (.keras).
—modelaudit scan integerlookup.evil.keras (and textvectorization.evil.keras) -> Clean / exit 0, but both use the identical keras.layers.IndexLookup external-vocabulary file-read/SSRF sink that CVE-2025-12058 covers for StringLookup. stringlookup.evil.keras is the POSITIVE CONTROL: the same external-vocab path -> CVE-2025-12058 WARNING/exit 1. Fires even under safe_mode=True.
—Root cause: keraszipscanner.py:1746 hardcodes if layer_class == "StringLookup", so IntegerLookup and TextVectorization never reach the vocabulary-path check; all three are in KNOWNSAFEKERASLAYERCLASSES so no other check fires. Fix: membership in {StringLookup, IntegerLookup, TextVectorization}. Distinct from the keras Lambda findings (this is the vocabulary string-path field -> file-read/SSRF, CWE-502/918, not Lambda code-exec).
—Benign: the vocabulary path reads a marker/canary file on load. In a real attack the path is /etc/passwd or an SSRF URL.

Files: integerlookup.evil.keras + textvectorization.evil.keras (bypass), stringlookup.evil.keras (fires). Full report in huntr submission.