Executive brief
kill-by-port is a Node.js utility for terminating processes listening on a specified network port. A vulnerability allows attackers to execute arbitrary system commands if they can control the port parameter passed to the function, potentially leading to unauthorized access or system compromise.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the killByPort function, which passes unsanitized user input directly to child_process.execSync(). An attacker who can control the port parameter can inject shell metacharacters (e.g., backticks, semicolons) to execute arbitrary commands. The attack requires that an application calls killByPort() with attacker-controlled input; no authentication is required if the vulnerable code path is reachable. The fix sanitizes the input by wrapping the port parameter with parseInt(port, 10) to ensure only numeric values are processed.
Affected products
- GuyMograbi kill-by-port before 0.0.2
Timeline
- 2021-04-13: disclosed
- 2021-03-31: patched: Fix committed on GitHub before public disclosure