← back
CVE-2021-21315

Command Injection Vulnerability

CVSS 7.1 HIGHEPSS 90.2%● KEVCWE-78
In short

A Node.js library called 'systeminformation' allows attackers to run unauthorized commands on a server if untrusted data is passed to certain functions like inetLatency() or services(). This happens because the library doesn't properly validate user input before executing system commands.

Technical detail

Command injection vulnerability in systeminformation <5.3.1 where functions (inetLatency, inetChecksite, services, processLoad) fail to sanitize parameters before passing them to shell command execution. Exploitation requires passing array or malicious string parameters to vulnerable functions; impact includes arbitrary command execution with the privileges of the Node.js process. Fixed in version 5.3.1 by implementing proper input validation.

Summary generated and translated by AI from the official description.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected products
sebhildebrandt · systeminformation
public PoCs found — 5
githubgithub.com/ForbiddenProgrammer/CVE-2021-21315-PoC★ 160githubgithub.com/alikarimi999/CVE-2021-21315★ 4githubgithub.com/G01d3nW01f/CVE-2021-21315★ 1githubgithub.com/xMohamed0/CVE-2021-21315-POC★ 0githubgithub.com/MazX0p/CVE-2021-21315-exploit★ 0
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2vhttps://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210312-0007/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315https://www.npmjs.com/package/systeminformation