CVE-2023-44392
📋 TL;DR
This vulnerability allows remote code execution through insecure deserialization in Garden's cryo library dependency. Attackers with Kubernetes cluster access can inject malicious objects into ConfigMaps, which execute when users run 'garden test' or 'garden run' commands. Only Garden versions prior to 0.13.17 (Bonsai) and 0.12.65 (Acorn) are affected.
💻 Affected Systems
- Garden
📦 What is this software?
Garden by Garden
Garden by Garden
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on the user's machine, potentially leading to complete system compromise, data theft, and lateral movement within the environment.
Likely Case
Privilege escalation within the Kubernetes cluster, unauthorized access to sensitive data in ConfigMaps, and potential compromise of Garden automation workflows.
If Mitigated
Limited impact due to required attacker access to Kubernetes cluster and user interaction with cached results, with proper network segmentation and access controls.
🎯 Exploit Status
Exploitation requires: 1) Kubernetes cluster access, 2) Ability to write to ConfigMaps, 3) User to execute 'garden test' or 'garden run' with cached results.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.13.17 (Bonsai) or 0.12.65 (Acorn)
Vendor Advisory: https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr
Restart Required: Yes
Instructions:
1. Stop all Garden services. 2. Update Garden to version 0.13.17 or 0.12.65 using your package manager. 3. Restart Garden services. 4. Clear existing cached results in ConfigMaps.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states no workarounds are available. Patching is required.
🧯 If You Can't Patch
- Restrict Kubernetes RBAC to prevent unauthorized ConfigMap modifications
- Disable caching of test/run results by modifying Garden configuration
🔍 How to Verify
Check if Vulnerable:
Check Garden version: 'garden --version'. If version is below 0.13.17 (Bonsai) or 0.12.65 (Acorn), you are vulnerable.Check Version:
garden --versionVerify Fix Applied:
1. Verify Garden version is 0.13.17+ or 0.12.65+. 2. Test that 'garden test' and 'garden run' commands work without deserialization errors. 3. Monitor for any suspicious activity in ConfigMaps.📡 Detection & Monitoring
Log Indicators:
- Unusual deserialization errors in Garden logs
- Suspicious modifications to ConfigMaps with 'test-result' or 'run-result' prefixes
- Unexpected process execution from Garden commands
Network Indicators:
- Unusual outbound connections from Garden processes
- Suspicious Kubernetes API calls modifying ConfigMaps
SIEM Query:
source="garden-logs" AND ("deserialization error" OR "unexpected object" OR "malformed cache")🔗 References
- https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c
- https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr
- https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c
- https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr
