CVE-2024-55459

Vulnerability

The vulnerability resides in the get_file function of Keras 3.7.0, which is used to download and cache files from URLs. When the function processes a tar archive (e.g., a .tar.gz file), it does not properly validate or sanitize the extracted file paths. A maliciously crafted tar file containing entries with directory traversal sequences (e.g., ../) can cause files to be written to arbitrary locations on the user's filesystem [1][2].

Exploitation

An attacker can exploit this by hosting a crafted tar file and luring a victim into using keras.utils.get_file to download it. No special authentication is required if the victim's code directly fetches the attacker-controlled URL. The attack surface is broad because get_file is commonly used in tutorial code, notebooks, and scripts to download model weights or datasets [1][2].

Impact

Successful exploitation allows an attacker to write arbitrary files to arbitrary locations on the victim's machine. This can lead to remote code execution if the attacker overwrites a system script, a Python library file, or a startup configuration. The CVSS score (likely high) reflects the potential for severe integrity and confidentiality impact, though availability is not directly compromised [2].

Mitigation

At the time of publication, a patched version of Keras 3.7.0 has not been announced. Users should avoid using get_file with untrusted URLs or manually validate extracted file paths. Security teams should monitor the Keras repository for a fix and apply it promptly [1][2].