Arbitrary Command Injection Affecting pidusage package, versions <1.1.5
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.26% (66th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:pidusage:20170605
- published 7 Jun 2017
- disclosed 5 Jun 2017
- credit micaksica
How to fix?
Upgrade pidusage to version 1.1.5 or higher.
Overview
pidusage is a package for Cross-platform process cpu % and memory usage of a PID.
Affected versions of the package are vulnerable to Arbitrary Command Injection. It passes user input to child_process.exec without sanitization, which causes a command injection vulnerability in the ps function due to never casting the PID to an integer.
PoC:
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');