Executive brief
node-os-utils is a Node.js library that monitors server health metrics. Versions before 1.1.0 fail to properly validate user input when executing system commands, allowing an attacker to run arbitrary commands on any server running the vulnerable library. This could lead to full system compromise, including data theft, service disruption, and deployment of malware.
Technical details
node-os-utils is vulnerable to remote code execution (CWE-94: Improper Control of Generation of Code) due to insufficient input validation when executing system commands. An attacker can inject arbitrary commands into the vulnerable API without authentication or user interaction. The attack is remotely exploitable over the network with low attack complexity. Successful exploitation allows an attacker to execute arbitrary system commands with the privileges of the Node.js process, potentially compromising the entire server. The vulnerability is fixed in version 1.1.0 and later.
Affected products
- node-os-utils node-os-utils <1.1.0
Timeline
- 2019-02-14: disclosed
- 2019-02-14: patched: Version 1.1.0 released with fix
- 2019-06-11: advisory