Executive brief
roar-pidusage is a Node.js library for monitoring CPU and memory usage of processes. A vulnerability in the stat() function allows attackers to execute arbitrary system commands if they can control the process ID input, potentially leading to complete system compromise.
Technical details
The vulnerability is an OS command injection (CWE-77) in the roar-pidusage library's stat() function. The root cause is the unsafe use of child_process.exec() without proper input sanitization, allowing attacker-controlled PID input to be interpolated into shell commands. An attacker providing malicious input to the stat() function can break out of the intended command context and execute arbitrary shell commands. The attack vector is network if the stat() function is exposed via an API, or local if exploited through application-supplied input. No authentication is required. All versions up to 1.1.7 are affected, though the impact varies by operating system.
Affected products
- roar-pidusage roar-pidusage 0 to 1.1.7
Timeline
- 2021-04-18: disclosed
- 2021-05-06: advisory