Executive brief
The 'serial-number' library, a Node.js module used to retrieve hardware identification strings from a computer, contains a security flaw that allows for unauthorized command execution. If an application passes untrusted data into this library, an attacker could take complete control of the underlying server or workstation. This could lead to the theft of sensitive data, installation of malware, or a total disruption of services.
Technical details
An OS command injection vulnerability exists in the 'serial-number' npm package (versions up to and including 1.3.0). The root cause is the lack of input validation or sanitization on the 'cmdPrefix' argument within the 'serialNumber' function, which is subsequently passed directly to the 'child_process.exec' function. An attacker who can influence this argument can execute arbitrary shell commands with the privileges of the Node.js process. While the library is intended for local hardware identification, any network-facing application that exposes this parameter to user input is at risk of remote code execution. As of the latest advisory, no official patch has been released.
Affected products
- es128 serial-number <= 1.3.0
Timeline
- 2020-02-28: disclosed: Vulnerability disclosed by Snyk and JHU System Security Lab.
- 2020-02-28: advisory: NVD published CVE-2019-10804.
- 2021-04-13: advisory: GitHub Advisory published.