PT-2019-17650 · Killport · Killport

Cris_Semmle · Published 2019-03-17 · Updated 2019-10-09 · CVE-2019-5414

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kill-port versions prior to 1.3.2

Description The issue allows an attacker to inject arbitrary OS commands due to the usage of the exec function in a third-party module. This is possible because the package does not validate user input on the kill function, which may allow attackers to run arbitrary commands in the system if user input, such as the port number, is passed directly to the function.

Recommendations Upgrade to version 1.3.2 or later. As a temporary workaround, consider restricting the use of the kill function in the kill-port module until a patch is available.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2019-5414

GHSA-PMV6-GF98-P3R5

Affected Products

Killport

References · 6

• 🔥 https://hackerone.com/reports/389561 · Exploit
• https://osv.dev/vulnerability/CVE-2019-5414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5414 · Security Note
• https://osv.dev/vulnerability/GHSA-pmv6-gf98-p3r5 · Vendor Advisory
• https://github.com/advisories/GHSA-pmv6-gf98-p3r5 · Note
• https://npmjs.com/advisories/966 · Note