PT-2018-13585 · Node.Js · Ps

Cris_Semmle · Published 2018-09-07 · Updated 2019-10-09 · CVE-2018-16460

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ps versions prior to 1.0.0

Description A command injection issue in the ps package for Node.js allows arbitrary commands to be executed when an attacker controls the PID. This can be exploited by manipulating the pid variable in the lookup function, enabling the execution of malicious commands. For instance, an attacker could use the pid variable to execute a command like $(touch success.txt), resulting in the creation of a file named success.txt on the filesystem.

Recommendations Update to version 1.0.0 or later. As a temporary workaround, consider restricting the use of the lookup function with user-controlled input until a patch is applied. Avoid using the pid variable in the lookup function with untrusted input to minimize the risk of exploitation.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2018-16460

GHSA-CFHG-9X44-78H2

Affected Products

Ps

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-16460 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16460 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cfhg-9x44-78h2 · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/470.json · Note
• https://npmjs.com/advisories/728 · Note
• https://github.com/advisories/GHSA-cfhg-9x44-78h2 · Note
• https://hackerone.com/reports/390848 · Note