Executive brief
pomelo-monitor is a Node.js monitoring library used to track application performance and health. A flaw in input validation allows an attacker to execute arbitrary commands on the server running the vulnerable version, potentially leading to complete system compromise, data theft, or service disruption. No patch is currently available, and users are advised to consider alternative modules.
Technical details
pomelo-monitor is vulnerable to Remote Code Execution (CWE-20: Improper Input Validation) across all versions. The vulnerability stems from insufficient validation of user-supplied input, which allows an attacker to inject and execute arbitrary commands on the server. The attack vector requires network access to the monitoring interface; specifics on whether authentication is required are not documented in the advisory. An attacker exploiting this flaw can achieve arbitrary code execution with the privileges of the application, enabling data exfiltration, system manipulation, or lateral movement. No fix is currently available, and the maintainers recommend switching to alternative monitoring solutions.
Affected products
- pomelo-monitor pomelo-monitor all versions
Timeline
- 2020-09-02: disclosed