GHSA-HFQ9-RFPV-J8R8严重已审查

Command Injection in pidusage

OSV 1.4.0 · github-reviewed · 修改于 2021-09-24 05:42

发布时间

2020-09-02 00:49

GitHub 审查时间

2020-09-01 02:20

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-hfq9-rfpv-j8r8/GHSA-hfq9-rfpv-j8r8.json

公告说明

Affected versions of pidusage pass unsanitized input to child_process.exec(), resulting in arbitrary code execution in the ps method.

This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable.

Proof of Concept

var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');

Recommendation

Update to version 1.1.5 or later.

受影响的软件包

npm

pidusage

ECOSYSTEM

引入0

标识信息

别名 / CVE

CVE-2017-16034

CWE

CWE-77

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-hfq9-rfpv-j8r8",
  "aliases": [
    "CVE-2017-16034"
  ],
  "details": "Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.\n \nThis package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.\n\nWindows and Linux are not vulnerable. \n\n## Proof of Concept\n```\nvar pid = require('pidusage');\npid.stat('1 && /usr/local/bin/python');\n```\n\n\n## Recommendation\n\nUpdate to version 1.1.5 or later.",
  "summary": "Command Injection in pidusage",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.5"
            }
          ]
        }
      ],
      "package": {
        "name": "pidusage",
        "ecosystem": "npm"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 1.1.4"
      }
    }
  ],
  "modified": "2021-09-23T21:42:30Z",
  "severity": [],
  "published": "2020-09-01T16:49:19Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16034",
      "type": "ADVISORY"
    },
    {
      "url": "https://www.npmjs.com/advisories/356",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T18:20:25Z"
  }
}