keras-team/keras 在 keras.utils.get_file() 中 Tar 归档文件解压时的路径遍历漏洞

攻击者可以利用此漏洞，通过构造恶意的 tar 归档文件，在 Keras 应用程序的预期目录之外写入任意文件。这可能导致攻击者覆盖关键系统文件，执行恶意代码，或窃取敏感数据。由于 Keras 广泛应用于机器学习和深度学习领域，该漏洞的潜在影响范围非常广泛。符号链接解析失败可能绕过安全措施，使得攻击者能够控制文件系统，从而进一步提升权限并执行恶意操作。类似于其他路径遍历漏洞，此漏洞可能被用于远程代码执行。

Organizations and individuals utilizing Keras for machine learning model development and deployment are at risk. This includes those using Keras within data pipelines that process external data sources, particularly if those sources are not thoroughly vetted. Users relying on shared hosting environments or pre-built container images containing Keras are also potentially vulnerable.

• python / keras:

import os
import tarfile

def check_keras_vulnerability(tar_file_path):
    try:
        with tarfile.open(tar_file_path, 'r') as tar:
            tar.extractall()
        print("Extraction successful - potential vulnerability")
    except Exception as e:
        print(f"Extraction failed: {e}")

# Example usage (replace with a potentially malicious tar file)
check_keras_vulnerability('malicious.tar.gz')

• python / keras: Monitor Keras logs for unusual file creation or modification events, particularly in unexpected directories. Look for errors related to symlink resolution or path length limits. • generic web: If Keras is deployed in a web application, monitor web server access logs for requests that attempt to upload or process tar archives from untrusted sources.

1. 2025-11-28Disclosure

   disclosure

1. 已保留2025-11-03
2. 发布日期2025-11-28
3. EPSS 更新日期2026-03-23

目前，官方建议升级到修复后的 Keras 版本。在无法立即升级的情况下，可以考虑使用 Web 应用程序防火墙 (WAF) 或代理服务器来过滤恶意 tar 归档文件。此外，可以限制 Keras 应用程序的权限，使其只能访问必要的目录和文件。务必审查所有上传的 tar 归档文件，并确保其来源可靠。升级后，请验证文件系统完整性，确认没有被恶意修改。