PT-2021-7658 · Npm · Systeminformation

Iva2K · Published 2021-02-16 · Updated 2025-10-24 · CVE-2021-21315

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.3.1

Description The System Information Library for Node.JS is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1, there is a command injection vulnerability. The problem was fixed in version 5.3.1. This vulnerability can be exploited by passing malicious parameters to certain functions, allowing an attacker to execute arbitrary commands. For example, the API endpoint "/api/getServices" can be exploited by passing a malicious "name" parameter, such as "name[]=$(echo -e 'test' > pwn.txt)".

Recommendations For systeminformation versions prior to 5.3.1, upgrade to version 5.3.1 or later to fix the command injection vulnerability. As a workaround, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... only allow strings, reject any arrays. String sanitation works as expected.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-01049

CVE-2021-21315

GHSA-2M8V-572M-FF2V

Affected Products

Systeminformation

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/sonicwall_cve_2021_20039.rb · Exploit
• 🔥 https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC · Exploit
• 🔥 https://github.com/alikarimi999/CVE-2021-21315 · Exploit
• https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525 · Patch
• https://bdu.fstec.ru/vul/2023-01049 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-21315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21315 · Security Note
• https://osv.dev/vulnerability/GHSA-2m8v-572m-ff2v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21315 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21315 · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation · Note
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315 · Note
• https://security.netapp.com/advisory/ntap-20210312-0007 · Note
• https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E · Note