PT-2018-13585 · Node.Js · Ps

Cris_Semmle · Publicado 2018-09-07 · Atualizado 2019-10-09 · CVE-2018-16460

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ps versions prior to 1.0.0

Description A command injection issue in the ps package for Node.js allows arbitrary commands to be executed when an attacker controls the PID. This can be exploited by manipulating the pid variable in the lookup function, enabling the execution of malicious commands. For instance, an attacker could use the pid variable to execute a command like $(touch success.txt), resulting in the creation of a file named success.txt on the filesystem.

Recommendations Update to version 1.0.0 or later. As a temporary workaround, consider restricting the use of the lookup function with user-controlled input until a patch is applied. Avoid using the pid variable in the lookup function with untrusted input to minimize the risk of exploitation.

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2018-16460

GHSA-CFHG-9X44-78H2

Produtos afetados

Ps

Referências · 7

• https://github.com/nodejs/security-wg/blob/master/vuln/npm/470.json · Nota
• https://npmjs.com/advisories/728 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-16460 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16460 · Aviso do Fabricante
• https://github.com/advisories/GHSA-cfhg-9x44-78h2 · Nota
• https://osv.dev/vulnerability/GHSA-cfhg-9x44-78h2 · Aviso do Fabricante
• https://hackerone.com/reports/390848 · Nota