Executive brief
port-killer is a Node.js utility used to terminate processes running on specific network ports. A security flaw allows an attacker to inject and execute their own commands on the underlying server if the application passes unsanitized user input to this tool. This could lead to a complete system takeover, unauthorized data access, or service disruption.
Technical details
The port-killer package is vulnerable to OS command injection (CWE-78) across all versions. The vulnerability exists because the library uses the Node.js child_process.exec function to execute shell commands without properly sanitizing or validating the input provided to it. An attacker who can control the input passed to the library's functions can execute arbitrary shell commands with the privileges of the Node.js process. While some assessments suggest high complexity, the NVD characterizes this as a network-based attack requiring low privileges. As of the advisory date, there is no known fixed version available.
Affected products
- tylerjpeterson port-killer All versions up to and including 1.0.1
Timeline
- 2021-02-23: disclosed: Vulnerability disclosed by OmniTaint
- 2021-03-18: advisory: NVD and Snyk published advisories
- 2021-04-13: disclosed: GitHub Advisory published