GHSA-hfq9-rfpv-j8r8

Source

https://github.com/advisories/GHSA-hfq9-rfpv-j8r8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hfq9-rfpv-j8r8/GHSA-hfq9-rfpv-j8r8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hfq9-rfpv-j8r8

Aliases

CVE-2017-16034

Published

2020-09-01T16:49:19Z

Modified

2023-11-08T03:59:00Z

Summary

Command Injection in pidusage

Details

Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

Proof of Concept

var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');

Recommendation

Update to version 1.1.5 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:20:25Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / pidusage

Package

Name: pidusage; View open source insights on deps.dev
Purl: pkg:npm/pidusage

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.1.5

Database specific

last_known_affected_version_range

"<= 1.1.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-hfq9-rfpv-j8r8/GHSA-hfq9-rfpv-j8r8.json"