soyuka/pidusage · Security
PIDUsage Enables OS Command Injection
- GHSA ID
- GHSA-h2p3-h48h-9jj7
- CVE ID
- CVE-2017-1000220
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Overview
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Remediation
Update to version 1.1.5 or later.
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')