critical9.8
CVE-2017-1000220
PIDUsage Enables OS Command Injection
Impact
### Overview Affected versions of pidusage pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method. This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX. Windows and Linux are not vulnerable. ### Proof of Concept ```js var pid = require('pidusage'); pid.stat('1 && /usr/local/bin/python'); ``` ### Remediation Update to version 1.1.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | pidusage | <= 1.1.4 | 1.1.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pidusage Project | Pidusage | through 1.1.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://nodesecurity.io/advisories/356
- https://github.com/advisories/GHSA-h2p3-h48h-9jj7
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000220
- https://web.archive.org/web/20201208183910/https://www.npmjs.com/advisories/356
- https://github.com/soyuka/pidusage/commit/b70eca15f7ca7f1b82a15f8a5d4bb48737f5a89d