Executive brief
pomelo-monitor is a Node.js application monitoring tool used to track operating system and process metrics. The tool is vulnerable to command injection attacks, allowing an attacker to execute arbitrary system commands on the server where the monitoring tool runs. This could lead to full system compromise, data theft, or service disruption depending on the privileges under which the monitoring application operates.
Technical details
pomelo-monitor versions up to 0.3.7 are vulnerable to OS command injection (CWE-78) in the `getPsInfo()` function and similar monitoring methods. The vulnerability exists because user-supplied parameters (such as the `pid` parameter) are passed unsanitized to shell command execution functions. An attacker without authentication can craft malicious input containing shell metacharacters (e.g., `&`, `;`, `|`) to inject arbitrary commands. Since the vulnerable component processes parameters passed directly to system calls without validation, an attacker can achieve remote code execution with the privileges of the Node.js process. No fixed version of pomelo-monitor has been released; users must either upgrade to an alternative monitoring solution or implement strict input validation and sandboxing at the application level.
Affected products
- pomelo-monitor pomelo-monitor 0 through 0.3.7
Timeline
- 2018-02-14: disclosed
- 2021-05-10: advisory