Junglewise Threat Intelligence

CVE-2022-25973: mc-kill-port arbitrary command execution in kill function

CVE-2022-25973 · Severity: low · CVSS 3.1 · Published 2022-08-11

Vendors: npm.

Executive brief

mc-kill-port is a software utility used by developers to stop processes running on specific network ports. A security flaw in this tool allows an attacker with local access to run unauthorized commands on the underlying system. This could lead to a full system takeover, data theft, or the deletion of critical files.

Technical details

All versions of the mc-kill-port npm package are vulnerable to arbitrary command execution (CWE-88/CWE-77). The vulnerability exists in the 'kill' function, which fails to sanitize the 'port' argument before passing it to a system shell command. An attacker who can control the input to this function can use shell metacharacters (e.g., pipes or semicolons) to execute arbitrary system commands with the privileges of the Node.js process. As of the latest advisory, there is no official patch available for this package.

Affected products

  • mc-kill-port project mc-kill-port All versions up to and including 1.0.1

Timeline

  • 2022-03-06: disclosed: Vulnerability first disclosed to Snyk
  • 2022-08-10: advisory: NVD publication date
  • 2022-08-11: advisory: GitHub Advisory Database publication date

References