Command Injection

Affecting lsof package, ALL versions

Overview

lsof is a lsof processor for node.

Affected versions of this package are vulnerable to Command Injection. Multiple areas of the package is vulnerable to command injection. Every exported method used by the packages uses the exec function to parse user input.

PoC by JHU System Security Lab

var root = require("lsof");
var attack_code = "& echo vulnerable > create.txt &";
root.rawTcpPort(attack_code, function(){});

Remediation

There is no fixed version for lsof.

References

• Vulnerable Code