CVE-2019-15599
📋 TL;DR
CVE-2019-15599 is a code injection vulnerability in the tree-kill npm package on Windows systems that allows remote code execution when an attacker can control command input. This affects any application using vulnerable versions of tree-kill on Windows. The vulnerability enables attackers to execute arbitrary commands with the privileges of the application using the package.
💻 Affected Systems
- tree-kill npm package
📦 What is this software?
Tree Kill by Tree Kill Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Application compromise allowing execution of arbitrary commands, potentially leading to lateral movement within the network.
If Mitigated
Limited impact through proper input validation and sandboxing, with only application-level compromise possible.
🎯 Exploit Status
Exploitation requires attacker to control input passed to tree-kill functions. Public proof-of-concept exists on HackerOne.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2 and later
Vendor Advisory: https://www.npmjs.com/advisories/1437
Restart Required: No
Instructions:
1. Update tree-kill package to version 1.2.2 or later using 'npm update tree-kill'. 2. Verify the update with 'npm list tree-kill'. 3. Restart any applications using tree-kill.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for any data passed to tree-kill functions
Process Sandboxing
windowsRun applications using tree-kill with reduced privileges or in sandboxed environments
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all user-controlled data passed to tree-kill
- Isolate affected applications in network segments with restricted outbound access
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list tree-kill' to see if version is below 1.2.2Check Version:
npm list tree-killVerify Fix Applied:
Verify tree-kill version is 1.2.2 or higher with 'npm list tree-kill'📡 Detection & Monitoring
Log Indicators:
- Unusual process tree termination patterns
- Suspicious command execution from node.js processes
Network Indicators:
- Unexpected outbound connections from node.js applications
- Command and control traffic patterns
SIEM Query:
Process creation where parent process contains 'node' and command line contains unusual arguments or shell metacharacters