Executive brief
The ps npm package is a Node.js library for querying running processes on a system. It fails to properly sanitize user input passed to the pid parameter, allowing attackers to inject arbitrary shell commands that execute with the privileges of the Node.js process. An attacker with the ability to control the pid input could execute malicious code, potentially compromising the entire server.
Technical details
The vulnerability is a classic OS command injection (CWE-78) resulting from improper input validation in the ps library versions before 1.0.0. The vulnerable component is the process lookup function, which constructs shell commands without properly escaping or validating the pid parameter. An attacker can pass shell metacharacters and command sequences (e.g., "$(touch success.txt)") to execute arbitrary commands on the host system. The vulnerability requires only network access if the application exposes the pid parameter to untrusted input, with no authentication or user interaction required. Patches are available in version 1.0.0 and later.
Affected products
- ps ps before 1.0.0
Timeline
- 2018-09-17: disclosed
- 2018-09-17: patched: Fix available in version 1.0.0