CVE-2021-23374: Command Injection in ps-visitor
Summary
CVE-2021-23374: Command Injection in ps-visitor. Affects ps-visitor versions < 0.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ps-visitor package is an npm package used for visiting and analyzing processes on a system. It provides functionality to interact with processes, including the ability to kill them. The vulnerability in ps-visitor allows an attacker to execute arbitrary commands by providing attacker-controlled user input to the kill function. This vulnerability exists in all versions up to and including version 0.0.2 of the package. The vulnerability arises due to the lack of input sanitization when using the child_process exec function.
Vulnerability Detail
The command injection vulnerability in ps-visitor allows an attacker to execute arbitrary commands on a system. By providing malicious input to the kill function, an attacker can manipulate the command executed by the child_process exec function. This can lead to various malicious activities, such as executing arbitrary code, gaining unauthorized access, or disrupting the normal functioning of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to a newer version of ps-visitor is not immediately possible, a temporary workaround can be implemented. It is advised to thoroughly validate and sanitize any user input before passing it to the kill function. By implementing proper input sanitization, the risk of command injection can be mitigated. Here is an example of how input sanitization can be done in JavaScript:
const { exec } = require('child_process');
function sanitizeInput(input) {
// Implement input sanitization logic here
return input;
}
const userInput = sanitizeInput(userInputFromUser);
exec(`kill ${userInput}`, (error, stdout, stderr) => {
// Handle the execution result
});
Conclusion
In conclusion, the ps-visitor package is vulnerable to command injection, allowing an attacker to execute arbitrary commands on a system. To mitigate this vulnerability, it is recommended to update to a version higher than 0.0.2 or implement proper input sanitization. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ps-visitor →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on a system. Depending on the privileges of the user running the vulnerable code, this can lead to unauthorized access, data breaches, or disruption of the system's normal operation.
While there are no known public exploits for this specific vulnerability at the moment, it is important to address it promptly to prevent any potential exploitation.
Yes, all versions up to and including version 0.0.2 of ps-visitor are affected by this vulnerability. It is recommended to update to a version higher than 0.0.2 to mitigate the risk.
Yes, the maintainers of ps-visitor have addressed this vulnerability in later versions by implementing input sanitization. It is advised to update to the latest version to ensure the vulnerability is patched.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
