PT-2019-14303 · Tree-Kill · Treekill

Publicado 2019-12-18 · Atualizado 2022-05-24 · CVE-2019-15599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tree-kill versions prior to 1.2.2

Description A Code Injection exists in tree-kill on Windows, allowing remote code execution when an attacker controls the input into the command. The issue arises from the failure to sanitize values passed to the kill function, which may allow attackers to run arbitrary commands on the server. This issue only affects Windows systems.

Recommendations Upgrade to version 1.2.2 or later. As a temporary workaround, consider restricting the use of the kill function in tree-kill until a patch is available. Avoid using user-controlled input in the kill function to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-15599

GHSA-884P-74JH-XRG2

GHSA-MXQ6-VRRR-PPMG

Produtos afetados

Treekill

Referências · 9

• 🔥 https://hackerone.com/reports/701183 · Exploit
• https://github.com/pkrumins/node-tree-kill/releases/tag/v1.2.2 · Nota
• https://github.com/pkrumins/node-tree-kill · Nota
• https://github.com/pkrumins/node-tree-kill/commit/deee138a8cbc918463d8af5ce8c2bec33c3fd164 · Nota
• https://osv.dev/vulnerability/CVE-2019-15599 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15599 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-884p-74jh-xrg2 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mxq6-vrrr-ppmg · Aviso do Fabricante
• https://t.me/cvenotify/22648 · Publicação no Telegram