Keras Path Traversal in Archive Extraction Utilities
Overview
Keras versions prior to 3.14.0 are susceptible to a critical path traversal vulnerability within its archive extraction utilities, specifically in `keras/src/utils/file_utils.py`. The `filter_safe_tarinfos()` and `filter_safe_zipinfos()` functions incorrectly validate archive member paths against the current working directory (CWD) rather than the intended extraction destination. This flaw becomes particularly dangerous when the CWD is set to the root directory ('/'), a common scenario in Docker containers, CI/CD pipelines, and Jupyter notebooks. In such environments, the validation essentially permits traversal up to the filesystem root, allowing malicious archives to write files to arbitrary locations. Further compounding the issue, the zip extraction filter exhibits an `AttributeError` when encountering blocked entries, potentially leading to incomplete or unexpected extractions. Python 3.11 users are further exposed as they lack the `filter="data"` safeguard, rendering them solely dependent on the compromised CWD-based validation. Successful exploitation enables attackers to overwrite critical system files, inject malicious code, or compromise the integrity of ML datasets and operational pipelines.
Affected Systems
Testing Guide
1. Create a specially crafted TAR or ZIP archive containing a file with a path traversal sequence (e.g., `../../../../../etc/passwd`). 2. Attempt to extract this archive using a Keras version prior to 3.14.0 in an environment where the CWD is set to '/'. 3. Verify if the traversal file is written outside the intended extraction directory (e.g., check for `/etc/passwd` modification or creation).
Mitigation Steps
- Update Keras to version 3.14.0 or later. - Ensure that the current working directory is not set to the filesystem root ('/') when extracting archives. - Implement stricter input validation on archive sources and contents. - Consider using sandboxing or containerization with carefully restricted CWDs and file system access for extraction processes. - Review and sanitize extracted file paths before use, especially in sensitive environments.
Patch Details
Keras version 3.14.0