Описание
PIDUsage Enables OS Command Injection
Overview
Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
Proof of Concept
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
Remediation
Update to version 1.1.5 or later.
Пакеты
Наименование
pidusage
npm
Затронутые версииВерсия исправления
<= 1.1.4
1.1.5
Связанные уязвимости
CVSS3: 9.8
nvd
около 8 лет назад
soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution