Executive brief
lsof is a Node.js package for listing open files and network connections. The package is vulnerable to OS command injection in all versions because it unsafely passes user input directly to shell execution functions. An attacker can inject arbitrary shell commands and execute them with the privileges of the application using the library, potentially leading to complete system compromise.
Technical details
The vulnerability is a classic OS command injection (CWE-78) affecting all versions of the lsof npm module (up to 0.0.4). Every exported method in the package uses Node.js's exec() function to parse user input without proper sanitization or escaping. An attacker can pass shell metacharacters (such as & or semicolons) within function parameters to inject and execute arbitrary commands. The attack requires network access if the application receiving the malicious input is network-exposed, and no authentication or user interaction is required. Proof-of-concept code demonstrates command execution by injecting shell operators. There is no fixed version available for this package.
Affected products
- lsof npm lsof all versions including 0.0.4
Timeline
- 2020-01-29: disclosed
- 2021-04-13: advisory