CVE-2021-21315 Command Injection Vulnerability

2021-02-1617:00:18

CWE-78

GitHub_M

www.cve.org

system information library

node.js

command injection

vulnerability

version 5.3.1

string sanitation

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS

0.971

Percentile

99.8%

JSON

The System Information Library for Node.JS (npm package “systeminformation”) is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() … do only allow strings, reject any arrays. String sanitation works as expected.

CNA Affected

[
  {
    "product": "systeminformation",
    "vendor": "sebhildebrandt",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.3.1"
      }
    ]
  }
]