Executive brief
The systeminformation library for Node.js, which is used to retrieve hardware and operating system details, contains a vulnerability that allows for unauthorized command execution. An attacker with local access to a system using this library could execute arbitrary operating system commands, potentially leading to full system compromise or data theft. This issue affects applications that pass unsanitized user input, particularly arrays, into specific library functions.
Technical details
A command injection vulnerability (CWE-78) exists in the systeminformation npm package before version 5.3.1. The root cause is improper neutralization of special elements in parameters passed to functions such as si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(). Specifically, the library failed to properly validate input types, allowing attackers to bypass string sanitization by passing arrays instead of strings. An attacker with local access can exploit this to execute arbitrary shell commands with the privileges of the Node.js process. The vulnerability is fixed in version 5.3.1 by implementing stricter parameter type checks.
Affected products
- Sebastian Hildebrandt systeminformation < 5.3.1
Timeline
- 2021-02-14: patched: Fix committed to repository
- 2021-02-16: disclosed: Security advisory published
- 2022-01-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
References
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
- https://github.com/sebhildebrandt/systeminformation
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210312-0007