Executive brief
systeminformation is a popular Node.js library that retrieves detailed system and hardware information. A command injection vulnerability allows an attacker with application-level access to inject malicious commands through vulnerable functions, potentially gaining code execution on the system running the application.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in systeminformation versions prior to 5.6.4. Vulnerable functions—including si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad()—fail to properly sanitize or validate user-supplied input (particularly array parameters) before passing them to shell commands. An authenticated attacker can exploit this by injecting shell metacharacters into service parameters, achieving arbitrary command execution. The fix involves parameter validation to reject arrays and properly sanitize string inputs. Upgrading to version 5.6.4 or later eliminates the vulnerability.
Affected products
- sebhildebrandt systeminformation < 5.6.4
Timeline
- 2021-04-02: disclosed
- 2021-04-06: patched: Version 5.6.4 released with parameter validation fix
- 2021-04-06: advisory: GHSA-jff2-qjw8-5476 published