CVE-2021-23359: Code Injection in port-killer
Summary
CVE-2021-23359: Code injection in port-killer. Affects port-killer versions < 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The port-killer package is an npm package that provides functionality for terminating processes running on specific ports. It is commonly used in Node.js applications to free up ports that are no longer in use. The package allows users to input port numbers to be terminated. However, a vulnerability has been discovered in all versions of port-killer that allows an attacker to execute arbitrary commands if user input is not properly sanitized. This vulnerability arises from the use of the child_process exec function without input validation. Exploiting this vulnerability can lead to unauthorized command execution and potential compromise of the system.
Vulnerability Detail
The vulnerability (CVE-2021-23359) in port-killer arises from the lack of input sanitization when using the child_process exec function. If an attacker-controlled user input is provided, it can be used to execute arbitrary commands on the system. This can lead to various consequences, such as unauthorized access, data manipulation, or even complete system compromise. In this specific case, running a proof-of-concept command 'touch success' would result in the creation of a file called 'success'. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by manually sanitizing user input before passing it to the port-killer package. This can be done by validating and filtering the input to ensure it only contains valid port numbers. Here is an example of how to sanitize user input in Node.js:
const port = parseInt(userInput, 10);
if (!isNaN(port) && port >= 0 && port <= 65535) {
// Pass the sanitized port number to port-killer
portKiller.kill(port);
} else {
// Handle invalid port number
console.error('Invalid port number');
}
Conclusion
The code injection vulnerability in port-killer (CVE-2021-23359) allows attackers to execute arbitrary commands on the system if user input is not properly sanitized. This can lead to unauthorized access and potential compromise of the system. It is crucial to update the port-killer package to the latest version (1.0.2) or apply input sanitization to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for port-killer →
FAQ
Port-killer is an npm package used for terminating processes running on specific ports. It helps free up ports that are no longer in use.
All versions of port-killer are affected, up to and including version 1.0.1.
An attacker can exploit this vulnerability by providing malicious input to the port-killer package, which can lead to the execution of arbitrary commands on the system.
Exploiting this vulnerability can result in unauthorized access, data manipulation, or even complete compromise of the system.
Yes, the maintainers of port-killer have released a fixed version (1.0.2) that addresses this vulnerability. Users should update to the latest version to mitigate the risk.
