critno cvss
CVE-2017-16034
Command Injection in pidusage
Also known as GHSA-hfq9-rfpv-j8r8
Published 6 y ago · modified 3 y ago · JSON
CVSS
—
not scored
CISA KEV
No
not known exploited
EPSS
—
no score (CVEs only)
Public exploits
0
none known
Summary
Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.
Windows and Linux are not vulnerable.
## Proof of Concept ``` var pid = require('pidusage'); pid.stat('1 && /usr/local/bin/python'); ```
## Recommendation
Update to version 1.1.5 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | pidusage | <1.1.5 | 1.1.5 |
Classification
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
- nvd.nist.gov /vuln/detail/CVE-2017-16034 · advisory
- npmjs.com /advisories/356 · web
Sources
- GitHub Advisory: GHSA-hfq9-rfpv-j8r8
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.