Executive brief
node-windows is a Node.js library used to install and manage Windows background services. The library fails to properly sanitize the process ID parameter passed to its kill method, allowing an attacker to inject and execute arbitrary operating system commands. An application using this library could be compromised to run malicious code with the privileges of the service running the Node.js application.
Technical details
The vulnerability exists in lib/cmd.js where the PID parameter is passed unsanitized to an OS command execution context. An attacker can supply a crafted PID string containing shell metacharacters (e.g., "12345; calc.exe") to the kill() function, which will execute injected commands alongside the intended process termination. The attack requires the attacker to control input to the kill() method, such as through user-supplied parameters or untrusted configuration. No authentication is required. The fix, applied in version 1.0.0-beta.6, properly escapes or validates the PID parameter before using it in command execution.
Affected products
- node-windows contributors node-windows before 1.0.0-beta.6
Timeline
- 2021-08-05: disclosed: Vulnerability disclosed on GitHub
- 2021-12-22: advisory: CVE-2021-45459 published
- 2021-09-19: patched: Fix committed in version 1.0.0-beta.6
- 2022-01-05: other: GHSA advisory published
References
- https://github.com/dwisiswant0/advisory/issues/4
- https://github.com/coreybutler/node-windows/commit/a379d31366edbd7a672a981e6c09e185ab448dd3
- https://advisory.dw1.io/4
- https://github.com/coreybutler/node-windows
- https://github.com/coreybutler/node-windows/compare/1.0.0-beta.5...1.0.0-beta.6
- https://security.netapp.com/advisory/ntap-20220107-0004