Command Injection Vulnerability
100Vexday Risk Score
Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.
ssvc Actcvss 7.1epss 91%
da publicação à arma13 dias
Publicada no NVD16 de fev.
1ª PoC+13d
CISA KEV+336d
probabilidade de exploração
91%top 1% das CVEs
exploração observada
simCISA + VulnCheck
8 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2022-02-01
Apply updates per vendor instructions.
Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Produtos afetados
sebhildebrandt · systeminformationPoCs públicas encontradas — 8
githubgithub.com/ForbiddenProgrammer/CVE-2021-21315-PoC★ 160githubgithub.com/alikarimi999/CVE-2021-21315★ 4githubgithub.com/G01d3nW01f/CVE-2021-21315★ 1githubgithub.com/MazX0p/CVE-2021-21315-exploit★ 0githubgithub.com/xMohamed0/CVE-2021-21315-POC★ 0vulncheckvulncheck.com/xdb/103f055d687bnão verificadovulncheckvulncheck.com/xdb/b335b010d8f4não verificadovulncheckvulncheck.com/xdb/82d28479bdcbnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2vhttps://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210312-0007/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315https://www.npmjs.com/package/systeminformation