Executive brief
Systeminformation is a Node.js library that collects system information including network details. When running on Windows, the library reads Wi-Fi network SSIDs and passes them unsanitized to the Windows command line (cmd.exe), allowing an attacker who can control a Wi-Fi SSID to execute arbitrary commands with the privileges of the user running the application.
Technical details
The vulnerability is a command injection flaw in the getWindowsIEEE8021x function within network.js. The SSID is retrieved from the output of "netsh wlan show interface" and then passed directly to "cmd.exe /d /s /c netsh wlan show profiles" without input sanitization. An attacker can craft a malicious SSID (e.g., a" | ping /t 127.0.0.1 &) that breaks out of the intended command context and executes arbitrary OS commands. The attack requires local access or the ability to set up a Wi-Fi network that the victim connects to, plus user interaction to trigger the vulnerable function. The vulnerability affects systeminformation versions up to and including 5.23.6; it was patched in version 5.23.7.
Affected products
- sebhildebrandt systeminformation <=5.23.6
Timeline
- 2024-12-20: disclosed
- 2024-12-20: patched: Fixed in version 5.23.7