Arbitrary Command Injection

Affecting portprocesses package, versions <1.0.5

Overview

portprocesses is a This tool letes you list and kill processes on a specified port.

Affected versions of this package are vulnerable to Arbitrary Command Injection. If (attacker-controlled) user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

PoC (provided by reporter):

var portprocesses = require('portprocesses');

portprocesses.killProcess('$(touch success)');

Remediation

Upgrade portprocesses to version 1.0.5 or higher.

References

• GitHub Commit
• Vulnerable Code