Executive brief
portprocesses is a Node.js library that manages operating system processes by port number. An arbitrary command injection vulnerability in this library allows an attacker who can control process names passed to the killProcess function to execute arbitrary shell commands with the same privileges as the running application.
Technical details
The vulnerability is a command injection flaw in the portprocesses library affecting versions 1.0.4 and earlier. The killProcess function fails to properly sanitize user-supplied input before passing it to shell execution commands, allowing shell metacharacters (like command substitution operators) to be interpreted. An attacker can exploit this by providing a malicious process name string containing shell commands (e.g., "$(touch success)") to execute arbitrary commands on the host system. The attack requires the attacker to be able to call the killProcess function with attacker-controlled input. The vulnerability was patched in version 1.0.5.
Affected products
- rrainn portprocesses <=1.0.4
Timeline
- 2021-03-31: disclosed
- 2021-04-06: patched: Version 1.0.5 released