Summary
The proctree Node.js package is vulnerable to command injection. Exploitation is possible via unsanitized shell metacharacters provided to the fix() function.
Product
All versions of the proctree NPM package.
Impact
This issue may lead to remote code execution on a machine running the proctree.
Steps to reproduce
var PsTree = require('proctree');
PsTree.getProcessTree("; touch HACKED &&")Expected result:
A file named HACKED has been created.
Remediation
No fix is currently available.
It is recommended to sanitize every untrusted input used by your applications.
Credit
This issue was discovered and reported by Checkmarx SCA Security Analyst Adar Zandberg.
