CVE-2021-21315: System Information Library for Node.JS Command Injection
Impact command injection vulnerability
Patches Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1
Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Other sources
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
— CISA
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/systeminformationto a version that resolves this vulnerability.Fixed in 5.3.1 - Configuration
Check and sanitize service parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() so that only strings are accepted and any arrays are rejected (do only allow strings, reject any arrays).
systeminformation (npm/systeminformation) - si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() parameter_type = string only; reject any arrays
Event History
Frequently Asked Questions
What is CVE-2021-21315?
CVE-2021-21315 is a command injection vulnerability in the System Information Library for Node.js.
What is the severity of CVE-2021-21315?
The severity of CVE-2021-21315 is high with a CVSS score of 7.8.
How does CVE-2021-21315 affect the System Information Library for Node.js?
CVE-2021-21315 affects the System Information Library for Node.js versions before 5.3.1.
How can I fix CVE-2021-21315?
To fix CVE-2021-21315, update the systeminformation npm package to version 5.3.1 or higher.
Are there any references for CVE-2021-21315?
Yes, you can find references for CVE-2021-21315 at the following links: - [GitHub Commit](https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525) - [GitHub Advisory](https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v) - [Apache Cordova Mailing List](https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E)