Executive brief
systeminformation is a popular Node.js library used to retrieve system hardware and software information. A command injection vulnerability allows attackers to execute arbitrary OS commands if they can control input passed to the library, potentially leading to system compromise.
Technical details
The vulnerability is an OS command injection (CWE-78) in systeminformation before version 4.30.2, where an attacker can overwrite object properties and functions to execute arbitrary OS commands. The vulnerability appears to be exploitable via network without authentication or user interaction, allowing an attacker with the ability to influence input to the library to achieve command execution. The attack vector involves prototype pollution or similar object manipulation that enables OS command injection. A fix was released in version 4.30.2.
Affected products
- systeminformation systeminformation before 4.30.2
Timeline
- 2020-11-26: disclosed
- 4.30.2: patched: Fixed in version 4.30.2
- 2022-02-09: advisory: GHSA-8j36-q8x7-pm6q published