CVE-2021-23375: Command Injection in psnode

Background

The psnode package is an npm package that provides functionality for interacting with the process list on a system. It allows users to retrieve information about running processes and perform actions such as killing processes. The package is widely used in various applications and systems.

Vulnerability Detail

The vulnerability identified as CVE-2021-23375 affects all current versions of the psnode package. It arises from a command injection vulnerability in the kill function. If an attacker-controlled user input is passed to the kill function without proper sanitization, it becomes possible for the attacker to execute arbitrary commands. This vulnerability is a result of the package's use of the child_process exec function without input validation. Exploiting this vulnerability can lead to unauthorized command execution with the privileges of the user running the affected application.

Workaround

As a temporary workaround, it is advised to implement input validation and sanitization for user-controlled input passed to the kill function. By carefully validating and filtering user input, the risk of command injection can be mitigated. Here is an example of how input validation can be implemented in Node.js:

const { exec } = require('child_process');

function killProcess(processId) {
  if (!/^[0-9]+$/.test(processId)) {
    throw new Error('Invalid process ID');
  }

  exec(`kill ${processId}`, (error, stdout, stderr) => {
    if (error) {
      console.error(`Error executing kill command: ${error.message}`);
      return;
    }

    console.log(`Process killed: ${stdout}`);
  });
}

Conclusion

In conclusion, the psnode package is vulnerable to a command injection vulnerability (CVE-2021-23375) that allows attackers to execute arbitrary commands. To mitigate this vulnerability, it is crucial to update the package to a version that includes the necessary fixes. Implementing input validation and sanitization for user-controlled input passed to the kill function can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for psnode →

FAQ