Executive brief
kill-process-on-port is a Node.js library used to terminate processes listening on a specified network port. The library is vulnerable to command injection when processing user-supplied port identifiers, allowing an attacker to execute arbitrary shell commands through specially crafted input.
Technical details
The kill-process-on-port npm package contains a command injection vulnerability (CWE-78) in the getProcessPortId function. The library constructs shell commands using unsanitized user input to identify and kill processes, allowing attackers to inject arbitrary shell metacharacters. The attack vector is network-based with no privileges or user interaction required; an application calling this library with untrusted port input can be exploited remotely. An attacker can achieve arbitrary command execution with the privileges of the Node.js process. No fixed version has been released; the vulnerability affects all versions including 1.0.2 and earlier.
Affected products
- npm kill-process-on-port 0 through 1.0.2
Timeline
- 2020-12-11: disclosed: Vulnerability disclosed by JHU System Security Lab
- 2021-02-01: advisory: NVD published CVE-2020-28426
- 2021-03-19: advisory: GitHub Security Advisory GHSA-5wqj-f379-6jh4 published