PT-2019-17650 · Killport · Killport

Cris_Semmle · Publicado 2019-03-17 · Atualizado 2019-10-09 · CVE-2019-5414

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kill-port versions prior to 1.3.2

Description The issue allows an attacker to inject arbitrary OS commands due to the usage of the exec function in a third-party module. This is possible because the package does not validate user input on the kill function, which may allow attackers to run arbitrary commands in the system if user input, such as the port number, is passed directly to the function.

Recommendations Upgrade to version 1.3.2 or later. As a temporary workaround, consider restricting the use of the kill function in the kill-port module until a patch is available.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2019-5414

GHSA-PMV6-GF98-P3R5

Produtos afetados

Killport

Referências · 6

• 🔥 https://hackerone.com/reports/389561 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5414 · Aviso do Fabricante
• https://github.com/advisories/GHSA-pmv6-gf98-p3r5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5414 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pmv6-gf98-p3r5 · Aviso do Fabricante
• https://npmjs.com/advisories/966 · Nota