Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oMnAzLWg0OGgtOWpqN84AAR2Q

PIDUsage Enables OS Command Injection

Overview

Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

Proof of Concept

var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');

Remediation

Update to version 1.1.5 or later.

Permalink: https://github.com/advisories/GHSA-h2p3-h48h-9jj7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMnAzLWg0OGgtOWpqN84AAR2Q
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: 5 months ago

CVSS Score: 9.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-h2p3-h48h-9jj7, CVE-2017-1000220
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000220
• https://web.archive.org/web/20201208183910/https://www.npmjs.com/advisories/356
• https://github.com/advisories/GHSA-h2p3-h48h-9jj7

Blast Radius: 43.7

Affected Packages