CVE-2019-10783
📋 TL;DR
CVE-2019-10783 is a critical command injection vulnerability in the lsof npm module that allows attackers to execute arbitrary commands on affected systems. The vulnerability affects all versions up to and including 0.0.4 because the package uses the exec() function without proper input validation. Any application using this vulnerable npm module is at risk.
💻 Affected Systems
- lsof npm module
📦 What is this software?
Isof by Isof Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Local privilege escalation or remote code execution depending on how the module is used, potentially leading to data theft or service disruption.
If Mitigated
Limited impact if proper input validation and sandboxing are implemented, though the vulnerability still exists in the underlying module.
🎯 Exploit Status
Exploitation is straightforward as it involves injecting shell commands through user-controlled input to the module's methods.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.5 and later
Vendor Advisory: https://snyk.io/vuln/SNYK-JS-LSOF-543632
Restart Required: Yes
Instructions:
1. Update package.json to specify lsof version 0.0.5 or later. 2. Run 'npm update lsof' or 'npm install lsof@latest'. 3. Restart your Node.js application.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all user inputs passed to lsof module methods.
Replace with Alternative Module
allReplace the vulnerable lsof module with a safer alternative that doesn't use exec() with user input.
npm uninstall lsof
npm install [alternative-package]
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all parameters passed to lsof module methods
- Run the application with minimal privileges and in a sandboxed/containerized environment
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list lsof' to see if version 0.0.4 or earlier is installed.Check Version:
npm list lsof | grep lsofVerify Fix Applied:
Run 'npm list lsof' and verify version is 0.0.5 or later, then test application functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Suspicious shell commands in application logs
- Unexpected process creation
Network Indicators:
- Unexpected outbound connections from Node.js processes
- Command and control traffic patterns
SIEM Query:
process.name: "node" AND cmdline: "*lsof*" AND (cmdline: "*;*" OR cmdline: "*|*" OR cmdline: "*`*" OR cmdline: "*$(*")