Executive brief
ps-visitor is a Node.js library that wraps system process management commands like `ps aux` and `kill`. The kill function does not sanitize user input before passing it to shell commands, allowing an attacker to inject arbitrary shell commands and execute them on the system where the application runs.
Technical details
This is a command injection vulnerability (CWE-77) affecting ps-visitor versions up to and including 0.0.2. The vulnerable code uses Node.js child_process.exec() without proper input sanitization on the pid parameter passed to the kill() function. An attacker who can control the pid argument can inject shell metacharacters to execute arbitrary commands with the privileges of the application process. The vulnerability requires only network reachability to the application and does not require authentication or user interaction. Patches or newer versions should use parameterized command execution (spawn with argv array) instead of exec().
Affected products
- WisdomKwan ps-visitor 0.0.2 and all earlier versions
Timeline
- 2021-05-07: disclosed
- 2021-05-06: advisory: GitHub reviewed