PT-2021-4725 · Npm · Systeminformation

Sebhildebrandt · Published 2021-03-15 · Updated 2021-05-05 · CVE-2021-21388

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.6.4

Description A command injection issue has been discovered in the systeminformation library for Node.js. This issue is related to errors in passing data to parameters of services such as si.inetLatency, si.inetChecksite, si.services, and si.processLoad. Exploitation of this issue could allow a remote attacker to execute arbitrary code. The problem has been fixed with a parameter check on user input.

Recommendations For versions prior to 5.6.4, upgrade to version >= 5.6.4. If you cannot upgrade, check or sanitize service parameters that are passed to functions like si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing only strings and rejecting any arrays.

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-20

CWE-77

CWE-78

Related Identifiers

BDU:2021-05431

CVE-2021-21388

GHSA-JFF2-QJW8-5476

Affected Products

Systeminformation

References · 13

• https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46 · Patch
• https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524 · Patch
• https://github.com/sebhildebrandt/systeminformation/commit/7922366d707de7f20995fc8e30ac3153636bf35f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21388 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21388 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21388 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21388 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05431 · Security Note
• https://osv.dev/vulnerability/GHSA-jff2-qjw8-5476 · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-jff2-qjw8-5476 · Note
• https://t.me/cvenotify/13947 · Telegram Post
• https://ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache-commons-and-node-js-affect-ibm-spectrum-protect-plus · Note
• https://npmjs.com/package/systeminformation · Note