ps Enables OS Command Injection

The impact of this vulnerability is severe. An attacker can inject arbitrary commands into the ps.lookup() function by crafting a malicious PID. This allows them to execute system commands with the privileges of the Node.js process, potentially leading to complete system compromise. Successful exploitation could result in data theft, malware installation, or denial of service. The proof-of-concept demonstrates the ease of exploitation, creating a file named 'success.txt' on the filesystem, highlighting the potential for more damaging commands.

Applications and systems using the ps Node.js module in their dependencies are at risk, particularly those that dynamically construct process IDs or do not properly sanitize user input used in the ps.lookup() function. Projects relying on outdated dependencies or those with weak input validation practices are especially vulnerable.

• nodejs / supply-chain:

Get-Process | Where-Object {$_.ProcessName -like '*node*'}

• nodejs / supply-chain:

Get-ChildItem -Path Env:NODE_PATH -Recurse -Filter 'ps*' | Select-Object FullName

• linux / server:

lsof -i -P | grep node

• linux / server:

ps aux | grep 'ps.lookup('  # Look for suspicious arguments

1. 2018-09-17Disclosure

   disclosure

1. Publicada2018-09-17
2. Modificada2023-11-08
3. EPSS atualizado2026-04-02

The primary mitigation is to upgrade the ps Node.js module to version 1.0.0 or later. If upgrading is not immediately feasible, consider implementing input validation on the PID parameter to prevent command injection. While a direct WAF rule is unlikely, a proxy could be configured to inspect the request for suspicious command patterns before forwarding it to the Node.js application. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for the creation of unexpected files (like 'success.txt' in the PoC) can be a useful indicator.