Executive brief
The kill-port-process package, a utility used by developers to stop processes running on specific network ports, is vulnerable to command injection. An attacker could exploit this to execute unauthorized commands on the underlying system where the package is running. This could lead to full system takeover, data theft, or disruption of services.
Technical details
The kill-port-process npm package prior to version 2.2.0 contains an OS command injection vulnerability (CWE-78/CWE-77). The root cause is the improper neutralization of special elements in externally-influenced input used to construct shell commands. An attacker can provide malicious input that is concatenated into a command string and executed by the system shell. This allows for unauthenticated remote code execution with the privileges of the process using the library. The issue is resolved in version 2.2.0.
Affected products
- hilleer kill-port-process < 2.2.0
Timeline
- 2019-08-12: disclosed: HackerOne report submitted
- 2020-02-28: advisory: NVD publication date
- 2022-02-10: advisory: GitHub Advisory Database publication date