CVE-2021-23380: Arbitrary command execution in roar-pidusage
Summary
CVE-2021-23380: Arbitrary command execution in roar-pidusage. Affects roar-pidusage versions < 1.1.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
roar-pidusage is an npm package that provides a way to retrieve process information for a given PID. It is commonly used in Node.js applications to monitor and manage processes. The package allows users to obtain statistics such as CPU usage, memory consumption, and more. However, all current versions of roar-pidusage are vulnerable to arbitrary command execution when attacker-controlled user input is passed to the stat function on certain operating systems. This vulnerability arises from the lack of input sanitization in the child_process exec function, which can be exploited by an attacker to execute arbitrary commands.
Vulnerability Detail
The vulnerability in roar-pidusage allows an attacker to execute arbitrary commands on the affected system. By providing malicious input to the stat function, an attacker can trigger the execution of arbitrary commands with the privileges of the process running the vulnerable package. This can lead to various security risks, including unauthorized access, data breaches, and remote code execution. The vulnerability has a CVSS score of 5.6, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to manually sanitize the user input before passing it to the stat function. This can be done by validating and filtering the input to ensure it only contains safe characters and does not include any command execution operators or special characters. Here's an example of how the input can be sanitized in Node.js:
const { exec } = require('child_process');
function sanitizeInput(input) {
// Perform input validation and filtering
const sanitizedInput = input.replace(/[&|;`$()\]/g, '');
return sanitizedInput;
}
const userInput = 'user-controlled-input';
const sanitizedInput = sanitizeInput(userInput);
exec(`stat ${sanitizedInput}`, (error, stdout, stderr) => {
// Handle the command execution result
});
Conclusion
The vulnerability in roar-pidusage can be mitigated by updating to the latest version of the package or implementing input sanitization. It is crucial to promptly address this vulnerability to prevent potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for roar-pidusage →
FAQ
roar-pidusage is an npm package used to retrieve process information for a given PID in Node.js applications. It provides statistics such as CPU usage and memory consumption.
The vulnerability in roar-pidusage allows an attacker to execute arbitrary commands by providing malicious input to the stat function.
The vulnerability can lead to unauthorized access, data breaches, and remote code execution on the affected system.
To fix this vulnerability, update to the latest version of the roar-pidusage package (1.1.8) or apply input sanitization to user-controlled input.
Yes, a temporary workaround is to manually sanitize the user input before passing it to the stat function.
