Executive brief
The killing package is a Node.js utility that terminates system processes by name or keyword. An attacker can inject arbitrary shell commands through unsanitized user input, allowing remote code execution on systems using this library without authentication. This could enable an attacker to gain full control over affected systems.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the killing package versions up to 1.0.6, stemming from unsafe use of the Node.js child_process.exec() function without input sanitization. When attacker-controlled input is passed to the process-killing functionality, shell metacharacters are not escaped, allowing arbitrary command injection. The attack requires network access to an application using the vulnerable library with attacker-controlled input, but does not require authentication or user interaction. An attacker can execute arbitrary commands with the privileges of the Node.js process.
Affected products
- xudafeng killing up to 1.0.6
Timeline
- 2021-04-19: disclosed
- 2021-05-06: advisory