Executive brief
windows-cpu is a Node.js library that retrieves CPU load statistics on Windows systems. The library fails to sanitize user input passed to the findLoad method, allowing attackers to execute arbitrary commands on the system. An attacker who can control the input to findLoad can achieve remote code execution and fully compromise a system running this library.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the findLoad method of windows-cpu versions before 0.1.5. The method passes unsanitized user input directly to a shell command execution function without proper escaping or validation. An attacker can inject shell metacharacters (e.g., "&" or ";") into the first argument of findLoad to execute arbitrary commands. No authentication is required; the attack only requires the ability to call the vulnerable function with attacker-controlled input. The vulnerability was patched in version 0.1.5 by properly sanitizing inputs before shell execution.
Affected products
- Kyle Ross windows-cpu before 0.1.5
Timeline
- 2020-09-01: disclosed
- 2017-04-13: patched: Fix committed to repository