Executive brief
Cryo is a Node.js library used for object serialization and deserialization. A critical security flaw allows attackers to execute arbitrary code on the server by sending specially crafted data. This could lead to a complete system takeover, data theft, or service disruption. There is currently no official fix, and users are advised to switch to an alternative library.
Technical details
All versions of the cryo npm package (up to and including 0.0.6) are vulnerable to insecure deserialization (CWE-502) leading to code injection (CWE-94). The vulnerability exists in the Cryo.parse method, which fails to properly sanitize or restrict the types of objects being reconstructed. An attacker can craft a JSON payload containing a serialized function string (prefixed with _CRYO_FUNCTION_) that is automatically executed during the hydration process. This can be exploited remotely without authentication if the application parses user-supplied input using Cryo. As of the latest advisory, no patch is available, and the library is considered deprecated/unsafe.
Affected products
- cryo_project cryo <= 0.0.6
Timeline
- 2018-08-17: advisory: NVD published CVE-2018-3784
- 2018-08-21: disclosed: GitHub Advisory published