Executive brief
mc-kill-port is a software utility used by developers to stop processes running on specific network ports. A security flaw in this tool allows an attacker with local access to run unauthorized commands on the underlying system. This could lead to a full system takeover, data theft, or the deletion of critical files.
Technical details
All versions of the mc-kill-port npm package are vulnerable to arbitrary command execution (CWE-88/CWE-77). The vulnerability exists in the 'kill' function, which fails to sanitize the 'port' argument before passing it to a system shell command. An attacker who can control the input to this function can use shell metacharacters (e.g., pipes or semicolons) to execute arbitrary system commands with the privileges of the Node.js process. As of the latest advisory, there is no official patch available for this package.
Affected products
- mc-kill-port project mc-kill-port All versions up to and including 1.0.1
Timeline
- 2022-03-06: disclosed: Vulnerability first disclosed to Snyk
- 2022-08-10: advisory: NVD publication date
- 2022-08-11: advisory: GitHub Advisory Database publication date