CVE-2019-5414: Command Injection in kill-port
Summary
CVE-2019-5414: Command Injection in kill-port. Affects kill-port versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kill-port package is an npm package used for killing processes running on specific ports. It provides a function called kill which takes a port number as input and terminates the process running on that port. The package is vulnerable to command injection, as it does not properly validate user input before passing it to the kill function. This allows attackers to execute arbitrary commands on the system if user input is directly passed to the function.
Vulnerability Detail
The vulnerability in kill-port arises from the lack of input validation on the kill function. When a user provides input (such as a port number) to the function, it is not properly sanitized or validated. This allows an attacker to inject malicious commands as part of the input, which will be executed by the system. The impact of this vulnerability can be severe, as it allows unauthorized execution of commands with the privileges of the user running the kill-port package.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
npm install kill-port@1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the kill-port package is not immediately possible, a temporary workaround can be implemented by manually validating and sanitizing user input before passing it to the kill function. This can be done by ensuring that the input only contains valid port numbers and does not include any special characters or command sequences.
Conclusion
The kill-port package prior to version 1.3.2 is vulnerable to command injection, allowing attackers to execute arbitrary commands on the system. It is crucial to upgrade to the latest version of the package or implement proper input validation to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for kill-port →
FAQ
The vulnerability allows attackers to execute arbitrary commands on the system, potentially leading to unauthorized access, data breaches, or disruption of services.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
While there may not be a specific known exploit for this vulnerability in the public domain, the presence of command injection can be leveraged by attackers to execute arbitrary commands and potentially gain unauthorized access to the system.
The recommended mitigation is to upgrade to the latest version of the kill-port package. Additionally, implementing proper input validation and sanitization in the application code can help mitigate the risk of command injection vulnerabilities.
Yes, this vulnerability is identified as CVE-2019-5414.
Related vulnerabilities
Recent vulnerabilities recorded for kill-port.
