CVE-2021-23360: Command Injection in killport
Summary
CVE-2021-23360: Command Injection in killport. Affects killport versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The killport package is an npm package used for terminating processes running on specific ports. It provides a command-line interface and an API for programmatically killing processes. The package is vulnerable to command injection, allowing an attacker to execute arbitrary commands. This vulnerability exists due to the lack of input sanitization when using the child_process exec function.
Vulnerability Detail
The vulnerability in the killport package allows an attacker to execute arbitrary commands by providing attacker-controlled user input. By exploiting this vulnerability, an attacker can execute malicious commands on the target system. In this specific case, running a proof-of-concept (PoC) command 'touch success' would create a file called 'success'. The impact of this vulnerability can range from unauthorized access to sensitive data to complete system compromise.
How To Fix
Minimum fixed version
1.0.2
This is the first release that contains the fix.
npm install killport@1.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advised to avoid using user-controlled input with the killport package until the vulnerability is fixed. Developers should ensure that any input passed to the package is properly validated and sanitized to prevent command injection.
Conclusion
The killport package is vulnerable to command injection, allowing an attacker to execute arbitrary commands. It is crucial to upgrade to version 1.0.2 or later and implement proper input sanitization to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for killport →
FAQ
The impact of this vulnerability can range from unauthorized access to sensitive data to complete system compromise. An attacker can execute arbitrary commands on the target system, potentially leading to further exploitation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it in real-time.
Yes, a fix is available in version 1.0.2 of the killport package. It is recommended to upgrade to this version or later to mitigate the vulnerability.
As a temporary workaround, it is advised to avoid using user-controlled input with the killport package. Ensure that any input passed to the package is properly validated and sanitized to prevent command injection.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/advisories/GHSA-fc42-h7q4-qp8h.
