CVE-2018-16460

Vulnerability

The ps npm package versions before 1.0.0 are vulnerable to command injection. The ps.lookup function does not properly sanitize the pid parameter, allowing an attacker to inject arbitrary shell commands when controlling the PID argument. [1][2][3]

Exploitation

An attacker can exploit this by providing a malicious PID value containing shell metacharacters. No authentication is required if the application exposes the ps.lookup function with user-controlled input, e.g., via a web API. The injected commands are executed with the privileges of the Node.js process. [2][3]

Impact

Successful exploitation leads to arbitrary command execution on the host system, potentially resulting in full compromise of the Node.js application and server. The attacker can execute arbitrary OS commands, read/write files, and pivot to other systems. [1][3]

Mitigation

Upgrade to version 1.0.0 or later. The fix was released in September 2018. No known workarounds; applications using user-controlled PID should sanitize input or avoid passing it to ps.lookup. [2][3]