CVE-2023-44392: Deserialization of Untrusted Data (CWE-502)
value: Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9
Published: 2023-10-09T20:15Z
Repository: https://github.com/garden-io/garden
Language: TypeScript
Files changed: core/package.json, core/src/plugins/kubernetes/run-results.ts, core/src/plugins/kubernetes/test-results.ts, core/src/util/serialization.ts
Commit date: 2023-10-04 11:01:50 +0000
Commit message: chore(deps): remove cryo (#5179)


Diff: diff --git a/core/package.json b/core/package.json
index 25a5f3ef9..90e41cf2a 100644
--- a/core/package.json
+++ b/core/package.json
@@ -51,11 +51,10 @@
     "cli-highlight": "^2.1.11",
     "cli-table3": "^0.6.3",
     "cli-truncate": "^2.1.0",
     "cpy": "^8.1.2",
     "cross-spawn": "^7.0.3",
-    "cryo": "0.0.6",
     "crypto-random-string": "^3.3.1",
     "date-fns": "^2.29.3",
     "dedent": "^0.7.0",
     "deline": "^1.0.4",
     "dependency-graph": "^0.11.0",
@@ -245,12 +244,12 @@
     "google-auth-library": "^9.0.0",
     "is-subset": "^0.1.1",
     "md5": "^2.3.0",
     "mocha": "^10.2.0",
     "nock": "^12.0.3",
-    "nodemon": "^2.0.15",
     "node-fetch": "^2.7.0",
+    "nodemon": "^2.0.15",
     "nyc": "^15.1.0",
     "p-event": "^4.2.0",
     "peggy": "^3.0.2",
     "prettier": "3.0.0",
     "ps-tree": "^1.2.0",
diff --git a/core/src/plugins/kubernetes/run-results.ts b/core/src/plugins/kubernetes/run-results.ts
index b4d78a83c..6aabc26b7 100644
--- a/core/src/plugins/kubernetes/run-results.ts
+++ b/core/src/plugins/kubernetes/run-results.ts
@@ -63,11 +63,13 @@ export const k8sGetRunResult: RunActionHandler<"getResult", any> = async (params
     }
   }
 }
 
 export function getRunResultKey(ctx: PluginContext, action: Action) {
-  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}`
+  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
+  const resultFormatVersion = 1
+  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}--${resultFormatVersion}`
   const hash = hasha(key, { algorithm: "sha1" })
   return `run-result--${hash.slice(0, 32)}`
 }
 
 interface StoreTaskResultParams {
diff --git a/core/src/plugins/kubernetes/test-results.ts b/core/src/plugins/kubernetes/test-results.ts
index 38e537c50..d6202613f 100644
--- a/core/src/plugins/kubernetes/test-results.ts
+++ b/core/src/plugins/kubernetes/test-results.ts
@@ -55,11 +55,13 @@ export const k8sGetTestResult: TestActionHandler<"getResult", any> = async (para
     }
   }
 }
 
 export function getTestResultKey(ctx: PluginContext, action: StoreTestResultParams["action"]) {
-  const key = `${ctx.projectName}--${action.name}--${action.versionString()}`
+  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
+  const resultFormatVersion = 1
+  const key = `${ctx.projectName}--${action.name}--${action.versionString()}--${resultFormatVersion}`
   const hash = hasha(key, { algorithm: "sha1" })
   return `test-result--${hash.slice(0, 32)}`
 }
 
 interface StoreTestResultParams {
diff --git a/core/src/util/serialization.ts b/core/src/util/serialization.ts
index 608ccb712..04f5e742d 100644
--- a/core/src/util/serialization.ts
+++ b/core/src/util/serialization.ts
@@ -5,11 +5,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  */
 
 import { mapValues } from "lodash"
-import Cryo from "cryo"
 import { writeFile } from "fs-extra"
 import { DumpOptions, dump } from "js-yaml"
 import highlight from "cli-highlight"
 import chalk from "chalk"
 
@@ -48,15 +47,15 @@ export function highlightYaml(s: string) {
 export async function dumpYamlMulti(yamlPath: string, objects: object[]) {
   return writeFile(yamlPath, encodeYamlMulti(objects))
 }
 
 export function serializeObject(o: any): string {
-  return Buffer.from(Cryo.stringify(o)).toString("base64")
+  return Buffer.from(JSON.stringify(o)).toString("base64")
 }
 
 export function deserializeObject(s: string) {
-  return Cryo.parse(Buffer.from(s, "base64"))
+  return JSON.parse(Buffer.from(s, "base64").toString())
 }
 
 export function serializeValues(o: { [key: string]: any }): { [key: string]: string } {
   return mapValues(o, serializeObject)
 }
diff --git a/package-lock.json b/package-lock.json
index fcf02d3d6..0d8d6c5cb 100644
Binary files a/package-lock.json and b/package-lock.json differ

Vulnerable code:     "cryo": "0.0.6",
    "nodemon": "^2.0.15",
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}`
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}`
import Cryo from "cryo"
  return Buffer.from(Cryo.stringify(o)).toString("base64")
  return Cryo.parse(Buffer.from(s, "base64"))
Fixed code:     "nodemon": "^2.0.15",
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.type}.${action.name}--${action.versionString()}--${resultFormatVersion}`
  // change the result format version if the result format changes breaking backwards-compatibility e.g. serialization format
  const resultFormatVersion = 1
  const key = `${ctx.projectName}--${action.name}--${action.versionString()}--${resultFormatVersion}`
  return Buffer.from(JSON.stringify(o)).toString("base64")
  return JSON.parse(Buffer.from(s, "base64").toString())