Executive brief
systeminformation is a Node.js library that retrieves system and hardware information. A command injection vulnerability allows attackers to execute arbitrary shell commands through unsanitized service parameter strings passed to functions like is.services(), is.inetChecksite(), and si.inetLatency(). This could lead to unauthorized code execution on systems using the vulnerable library.
Technical details
A command injection vulnerability (CWE-78) exists in systeminformation due to insufficient sanitization of shell command parameters. The vulnerability affects multiple functions including is.services(), is.inetChecksite(), si.inetLatency(), si.networkStats(), and si.processLoad(). Attackers can inject malicious shell commands through unsanitized service parameter strings. The vulnerability requires no authentication or user interaction, only that an application uses the affected functions with untrusted input. The issue was resolved in version 4.26.2 through shell string sanitation fixes.
Affected products
- sebhildebrandt systeminformation < 4.26.2
Timeline
- 2020-10-27: disclosed
- 2020-10-27: patched: Fixed in version 4.26.2
- 2021-09-09: advisory: CVE-2020-26300 published