Executive brief
pidusage is a Node.js library that retrieves process resource usage statistics. Versions before 1.1.5 allow attackers to inject arbitrary OS commands through unsanitized input passed directly to the shell, enabling remote code execution on affected systems (Darwin, SunOS, FreeBSD, and AIX). This could allow an attacker to compromise the application and access sensitive data or disrupt operations.
Technical details
The vulnerability is an OS command injection flaw (CWE-78) in the ps method of pidusage. The library passes unsanitized PID input directly to child_process.exec() without validation or escaping, allowing attackers to append shell metacharacters and commands (e.g., `pid.stat('1 && /usr/local/bin/python')`). The vulnerability is reachable via the public stat() method with no authentication required. Exploitation results in arbitrary code execution with the privileges of the application process on Darwin, SunOS, FreeBSD, and AIX platforms; Windows and Linux are not affected. The fix (version 1.1.5 and later) casts the PID input to an integer, preventing command injection.
Affected products
- pidusage pidusage < 1.1.5
Timeline
- 2017-11-17: disclosed
- 2022-05-13: advisory: GHSA published
- 2017: patched: Fix released in version 1.1.5