CVE-2020-7785: Command injection in node-ps

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The package under scrutiny is node-ps, an npm package. It provides functionality for executing system commands and retrieving information about running processes in a Node.js environment. The vulnerability affects all versions of the package. It is important to note that the injection point is located in line 72 of the lib/index.js file.

Vulnerability Detail

The vulnerability in node-ps is a command injection vulnerability. This means that an attacker can manipulate user input to execute arbitrary commands on the system. The injection point in line 72 of lib/index.js allows an attacker to inject malicious commands, potentially leading to unauthorized access, data leakage, or remote code execution. This vulnerability has a CVSS score of 9.8, indicating its critical severity.

Workaround

If updating the package is not immediately feasible, a temporary workaround can be implemented by sanitizing user input and ensuring that any command execution is properly validated and restricted. Here is an example of how to sanitize user input in Node.js:

const { exec } = require('child_process');

function executeCommand(command) {
  const sanitizedCommand = command.replace(/[&|;$`\<>]/g, '');
  exec(sanitizedCommand, (error, stdout, stderr) => {
    // Handle command execution results
  });
}

Conclusion

In conclusion, the node-ps package is vulnerable to a command injection vulnerability that allows attackers to execute arbitrary commands on the system. It is crucial to update the package to a secure version or implement the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for node-ps →

FAQ