Command Execution

Overview

Version of windows-cpu before 0.1.5 will execute arbitrary code passed into the first argument of the findLoad method, resulting in remote code execution.

Proof of Concept

var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');

Recommendation

Update to version 0.1.5 or later.

References

• https://github.com/KyleRoss/windows-cpu/blob/master/index.js#L81
• https://github.com/KyleRoss/windows-cpu/commit/b75e19aa2f7459a9506bceb577ba2341fe273117
• GitHub Advisory