T06 · System Persistence
Error
- Location
- SKILL.md:54
- Finding
- PM2 Boot-Time Persistence Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 54-62 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High **Vulnerable Code**: ```bash ## Auto-Start on Boot ```bash # Save current process list pm2 save # Generate startup script (run the output command with sudo) pm2 startup # Example output - run this: # sudo env PATH=$PATH:/opt/homebrew/bin pm2 startup launchd -u username --hp /Users/username ``` ### Technical Analysis The documented workflow saves the current PM2 process list and generates an operating-system startup integration. The generated command may be executed with `sudo`, allowing the configured PM2 applications to start automatically after reboot. Although this functionality is consistent with PM2's intended operational purpose and is explicitly disclosed, it creates cross-session persistence. If an untrusted application, command, or ecosystem configuration has previously been added to PM2, saving the process list and enabling startup will make that payload execute automatically on subsequent boots. ### Attack Path 1. An attacker causes a user to start an attacker-controlled application or PM2 ecosystem configuration. 2. The application becomes part of the active PM2 process list. 3. The user follows the Skill and runs `pm2 save`. 4. The user runs `pm2 startup` and executes its generated command with `sudo`. 5. PM2 restores the saved process list after reboot. 6. The attacker-controlled application executes persistently under the configured PM2 account. ### Impact Assessment Successful exploitation provides recurring execution after system reboot under the account configured for PM2. The payload normally inherits that account's permissions. The startup installation itself may require administrative privileges, increasing system-level impact, although managed applications do not necessarily run as root. The affected scope includes every application in the saved ...[truncated 77 chars]
- Remediation
- ## Remediation Suggestions - Remove boot-persistence instructions if cross-session startup is not strictly required by the Skill. - Require explicit, informed user approval before running `pm2 save`, `pm2 startup`, or any generated privileged command. - Display and validate the complete PM2 process list before saving it. - Verify each script path, working directory, argument, environment variable, and ecosystem configuration before enabling startup. - Run managed applications through a dedicated least-privilege service account rather than an administrative account. - Do not execute generated commands with `sudo` until their paths, target user, home directory, and startup mechanism have been reviewed. - Document rollback procedures using `pm2 unstartup`, `pm2 delete`, and removal of the saved process list where appropriate. - Periodically audit enabled startup entries and saved PM2 applications for unauthorized changes.