CVE-2021-23374
📋 TL;DR
CVE-2021-23374 is a command injection vulnerability in the ps-visitor npm package that allows attackers to execute arbitrary commands on the host system. This occurs when untrusted user input is passed to the kill function, which uses child_process.exec without proper sanitization. All users of ps-visitor are affected.
💻 Affected Systems
- ps-visitor
📦 What is this software?
Ps Visitor by Ps Visitor Project
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining remote code execution, data exfiltration, and lateral movement capabilities.
Likely Case
Limited command execution within the application's context, potentially leading to data leakage or service disruption.
If Mitigated
No impact if input validation prevents untrusted data from reaching the vulnerable function.
🎯 Exploit Status
Exploitation is straightforward if attacker-controlled input reaches the vulnerable function. No authentication required for the vulnerable code path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/WisdomKwan/ps-visitor/security/advisories
Restart Required: No
Instructions:
No official patch exists. Remove ps-visitor from dependencies and replace with alternative package or implement input validation workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to ensure only trusted, expected values reach the kill function.
Replace child_process.exec with child_process.execFile
allModify the source code to use execFile instead of exec, which doesn't spawn a shell and prevents command injection.
🧯 If You Can't Patch
- Remove or disable functionality that uses the kill function with user input
- Implement network segmentation and strict firewall rules to limit potential damage from exploitation
🔍 How to Verify
Check if Vulnerable:
Check package.json for ps-visitor dependency and review code to see if user input flows to the kill function.Check Version:
npm list ps-visitorVerify Fix Applied:
Verify ps-visitor is removed from dependencies and no user input reaches any kill function calls.📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from Node.js application
- Unexpected command execution patterns
Network Indicators:
- Outbound connections from Node.js process to unexpected destinations
SIEM Query:
process.name:node AND (process.args:*kill* OR process.args:*exec*)