Executive brief
proctree is a Node.js library used to manage and manipulate process trees. A command injection vulnerability in the fix function allows attackers to execute arbitrary system commands, potentially leading to complete system compromise or data theft.
Technical details
The vulnerability is an OS command injection (CWE-78) in the proctree library affecting versions through 0.1.1. The fix function fails to properly sanitize user-controlled input before passing it to system command execution. An attacker can inject arbitrary commands via the vulnerable function to execute code with the privileges of the Node.js process. The attack vector is local or network-dependent on how the application uses proctree; the vulnerability requires the application to call the fix function with untrusted input. A fix or patch availability status is not explicitly mentioned in the advisory.
Affected products
- allenhwkim proctree through 0.1.1
Timeline
- 2022-06-02: disclosed
- 2022-06-03: advisory