Executive brief
systeminformation is a Node.js library that retrieves system information such as CPU, memory, and network statistics. A command injection vulnerability in the inetLatency() function allows authenticated attackers to execute arbitrary shell commands by manipulating service parameter strings, potentially leading to unauthorized system access or data manipulation.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the inetLatency() function caused by insufficient sanitization of shell string parameters. An attacker who can pass malicious input to the service parameter can inject arbitrary shell commands for execution. The attack requires an authenticated caller with access to invoke the inetLatency() function. The vulnerability was resolved by implementing proper shell string sanitation in version 4.31.1. All versions prior to 4.31.1 are affected.
Affected products
- systeminformation systeminformation < 4.31.1
Timeline
- 2020-12-16: disclosed
- 2020-12-16: patched: Version 4.31.1 released with shell string sanitization fix