CVE-2017-16034: Command Injection in pidusage
Summary
CVE-2017-16034: Command Injection in pidusage. Affects pidusage versions < 1.1.5. Fixed in 1.1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pidusage is an npm package that provides information about the resource usage of a process. It allows users to retrieve statistics such as CPU and memory usage for a given process ID. However, versions of pidusage prior to 1.1.5 are vulnerable to command injection. This means that unsanitized input is passed to the child_process.exec() function, which can result in arbitrary code execution in the ps method. The vulnerability affects Darwin, SunOS, FreeBSD, and AIX platforms, while Windows and Linux are not vulnerable.
Vulnerability Detail
The vulnerability in pidusage allows an attacker to execute arbitrary code by injecting malicious commands. By exploiting this vulnerability, an attacker can potentially gain unauthorized access, escalate privileges, or perform other malicious actions on the affected system. The vulnerability arises due to the lack of input sanitization, which allows an attacker to inject arbitrary commands that are executed within the context of the ps method.
How To Fix
Minimum fixed version
1.1.5
This is the first release that contains the fix.
npm install pidusage@1.1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can implement a workaround by manually sanitizing the input before passing it to the pidusage.stat() method. This can be done by validating and filtering the input to ensure that it does not contain any malicious characters or commands. Here's an example of how to sanitize the input using JavaScript:
var pid = require('pidusage');
var input = '1 && /usr/local/bin/python';
var sanitizedInput = input.replace(/[&|;`$()\]/g, '');
pid.stat(sanitizedInput);
Conclusion
In conclusion, the pidusage package prior to version 1.1.5 is vulnerable to command injection, which can lead to arbitrary code execution. It is crucial to update to the latest version of pidusage to mitigate this vulnerability. If immediate update is not possible, implementing input sanitization can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pidusage →
FAQ
pidusage is an npm package that provides information about the resource usage of a process. It allows users to retrieve statistics such as CPU and memory usage for a given process ID.
Versions of pidusage prior to 1.1.5 are affected by this vulnerability.
This vulnerability affects Darwin, SunOS, FreeBSD, and AIX platforms. Windows and Linux platforms are not vulnerable.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a target system. It occurs when unsanitized user input is passed to a command execution function, allowing the injection of additional commands.
To protect your system, it is recommended to update pidusage to version 1.1.5 or later. Additionally, ensure that all user input is properly sanitized before using it in command execution functions.
References
Related vulnerabilities
Recent vulnerabilities recorded for pidusage.
