CVE-2021-23355: Command Injection in ps-kill

Background

The ps-kill package is an npm package used for terminating processes on a system. It provides a convenient way to kill processes based on their process ID (PID) or name. The package is widely used in various applications and environments.

Vulnerability Detail

The vulnerability (CVE-2021-23355) in ps-kill allows an attacker to execute arbitrary commands by injecting malicious input. This occurs due to the lack of input sanitization in the kill function of the package's index.js file. By providing attacker-controlled input to the kill function, an attacker can execute arbitrary commands on the system. The vulnerability has a CVSS score of 9.8 (Critical), indicating its severity. Exploiting this vulnerability can lead to unauthorized command execution and potential compromise of the affected system.

Workaround

As a temporary workaround, users can implement input sanitization or validation before passing user input to the kill function. This can help prevent command injection attacks. Here is an example of how input validation can be implemented in Node.js:

const ps_kill = require('ps-kill');

function sanitizeInput(input) {
  // Implement input sanitization logic here
  // Return sanitized input
}

const userInput = '$(touch success)';
const sanitizedInput = sanitizeInput(userInput);

ps_kill.kill(sanitizedInput, function() {
  // Callback function
});

Conclusion

The ps-kill package is vulnerable to a command injection vulnerability (CVE-2021-23355) that allows attackers to execute arbitrary commands on the system. To mitigate this vulnerability, it is crucial to update the package to version 1.0.1 or later. Implementing input sanitization or validation can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ps-kill →

FAQ