galarza fonda

The Galarza Fonda vulnerability exposes a fundamental flaw in how cloud providers chain function invocations - and most teams aren't even looking for it.

Over the last year, our platform engineering team at a large fintech ran a thorough threat model against our serverless pipeline. What we uncovered wasn't a misconfigured IAM role or an overly permissive event source. It was a novel class of deserialization bug that could silently escalate privileges across chained Lambda functions - Azure Functions, and even Cloudflare Workers. Internally, we've been calling it Galarza Fonda - named after the pair of researchers who first documented the race condition that makes it possible. The attack doesn't just bypass runtime isolation; it uses the very orchestration primitives designed to speed up cold starts as a side-channel to inject arbitrary objects into downstream functions.

What makes Galarza Fonda so dangerous is that it isn't a flaw in a single runtime. It's a byproduct of how polyglot, event-driven architectures handle serialized invocation payloads when multiple functions share a common memory bus, a scheduler. Or a containerized execution environment. If you're running AWS Step Functions with Express Workflows, Azure Durable Functions, or even a custom Knative event mesh, you're almost certainly vulnerable unless you've taken very specific defensive measures. This article is a technical deep get into the inner workings of Galarza Fonda, how it survives routine security audits. And what you can do right now to harden your estate.

Understanding the Galarza Fonda Attack Vector

At its core, Galarza Fonda exploits a nuanced interaction between function invocation optimization and polymorphic deserialization. Cloud providers aggressively cache and reuse execution contexts to reduce cold start latency. In AWS Lambda, for example, the same Firecracker microVM and language runtime process can be reused for hundreds of invocations. The connection between the orchestration plane and the execution environment relies on a standard invocation protocol - typically a JSON payload delivered over a local HTTP endpoint inside the microVM. That payload contains metadata, the event object, and sometimes pre-warmed dependencies.

When a function is part of a chain - say, a Step Function that fans out to three downstream Lambdas - the serialization library inside each execution context must deserialize the incoming payload into a typed object. The polymorphic nature of languages like Java, Python. Or JavaScript means the deserializer often consults a type hint or a discriminator field to decide which class to instantiate. In Galarza Fonda, an attacker who controls an intermediate function (or the initial payload via a poisoned SQS message) can inject a payload that uses a type hint referencing a class that isn't loaded in the first function's runtime but is loaded in a downstream execution context because of a different dependency set. The scheduler delivers the serialized bytes directly,, and and the downstream deserializer trusts themThis results in arbitrary object injection across function boundaries, effectively breaking the isolation model that serverless architectures promise.

We originally reproduced the Galarza Fonda vector using a simple Python Lambda chain where the upstream function wrote a pickled object to the output and the downstream function, running a different Lambda Layer with a custom `__reduce__` method, executed arbitrary code upon unpickling. The AWS runtime never flagged it because both functions had valid IAM permissions. And the payload passed all schema validation - the exploit lived entirely in the deserialization logic.

How Galarza Fonda Exploits Serverless Invocation Chaining

Serverless invocation chaining isn't just about explicit connectors like Step Functions. It also happens implicitly when one function publishes to an SNS topic that triggers another, or when a DynamoDB stream flows into a Lambda. In each case, the runtime wraps the event in a standard envelope that includes a `requestContext` and, in some providers, optional `clientContext` fields. The Galarza Fonda technique inserts a crafted stream of bytes into these trusted fields - bytes that resemble a legitimate serialized object but contain a "trojan class" descriptor.

Using a man-in-the-middle approach during local testing with the Serverless Application Model (SAM), we discovered that the AWS Lambda runtime internally uses a Netty-based HTTP handler that reads the entire invocation body into a byte buffer before passing it to the function handler. If the function is written in a JVM language, the Jackson `ObjectMapper` or the built-in Kryo serializer might be configured to accept polymorphic type resolution. We crafted a payload that set `@class` to a known Spring gadget class, even though the upstream function didn't have Spring on its classpath. The execution context of the downstream function, however, had Spring Boot embedded in its Lambda Layer. The result was a textbook deserialization remote code execution (RCE), crossing what should have been an unbreachable trust boundary.

The scary part: conventional API Gateway schema validators and even AWS WAF didn't block this because the payload looked like valid JSON and carried no SQL injection or scripting signatures. The Galarza Fonda payload was simply a well-formed invocation event with an extra `__type` hint that triggered a gadget chain. This is why many teams remain unaware - the attack leaves no obvious trace in CloudTrail beyond a normal `InvokeFunction` entry.

Real-World Impact: Galarza Fonda in Production Environments

During a simulated red-team exercise on our staging environment, we managed to turn a single compromised Lambda (an image-resizer function exposed via API Gateway) into a full privilege escalation path. The function had write access to an S3 bucket used for storing user uploads. By crafting a Galarza Fonda payload and passing it as an output to an internal orchestrator, we gained code execution inside a downstream billing function that had read/write access to DynamoDB tables holding payment tokens. In under two minutes, we exfiltrated encrypted card data - all without triggering a single GuardDuty alert.

We later tested the same approach against Azure Functions with Durable Functions using an orchestration trigger. The serialized payload traveled inside a `DataContractSerializer` envelope. And we were able to exploit the known `ObjectDataProvider` chain in. NET framework-based functions, even though the runtime claimed to run in isolated sandbox mode. The issue wasn't isolated to a single cloud; it was a systemic weakness in how durable execution frameworks pass opaque state between steps. We've since confirmed that similar conditions exist in Google Cloud Workflows when using Connectors that deserialize JSON into concrete types.

From an operational standpoint, the blast radius of a successful Galarza Fonda exploit is amplified by the inherent trust between internal functions. Most teams don't apply mutual TLS or mTLS between chained functions because they assume the invocation is server-side and therefore safe. But once an attacker can influence the serialized payload, that trust becomes a highway for lateral movement.

The Technical Mechanics Behind Galarza Fonda Payloads

Let's dissect a minimal Galarza Fonda payload for a Java-based Lambda. We used the `ysoserial` tool to generate a CommonsCollections6 gadget chain, then wrapped it in a JSON structure that the runtime's ObjectMapper would honor. The key field was `@class` or `__type`, depending on the deserialization library, and by setting `@class` to `orgapache, and commonscollections, but functors. InvokerTransformer`, we triggered a chain that ultimately called `Runtime, and getRuntime()exec()`. While the payload looked something like this inside the invocation envelope:

{ "requestContext": { "requestId": "legit-id", "functionArn": "arn:aws:lambda:. ", "clientContext": { "custom": { "__proto__": {. }, "@class": "org, and apachecommons, and col