Executive brief
portkiller is a Node.js utility for terminating processes on specified network ports. A command injection vulnerability allows attackers to execute arbitrary system commands if attacker-controlled input is passed to the application without sanitization, potentially compromising system integrity and confidentiality.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the portkiller npm package that affects all versions through 1.0.3. The root cause is unsafe use of Node.js child_process.exec() function without input validation or sanitization of user-supplied data. An unauthenticated network attacker can exploit this by providing malicious input containing shell metacharacters to execute arbitrary commands with the privileges of the process running portkiller. No patch is publicly documented; users should upgrade or discontinue use of the package.
Affected products
- portkiller portkiller through 1.0.3
Timeline
- 2021-04-18: disclosed
- 2021-05-06: advisory