Command Injection Vulnerability
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.3.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The systeminformation package for Node.js, a library used to retrieve hardware, system, and OS details, is affected by a command injection flaw. An attacker who can influence the service parameters passed to certain of its functions could cause unintended commands to run on the host system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- sebhildebrandt systeminformation
fixed in 5.3.1
- systeminformationnpm
fixed in 5.3.1
References 5
npmjs.com
GitHub · sebhildebrandt/systeminformation
lists.apache.org
security.netapp.com
Questions about CVE-2021-21315
What does this mean?
Service parameters passed to functions such as si.inetLatency(), si.inetChecksite(), si.services() and si.processLoad() were not checked, so a crafted value can inject commands into the operating system.Source: github.com
Am I affected, and how do I check?
All systeminformation versions before 5.3.1 are affected when code passes service parameters to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() or similar functions. To check, run npm ls systeminformation in the project or look at the version listed in package.json.Source: github.com
What should I do about it?
Upgrade systeminformation to version 5.3.1 or later, which adds a parameter check that fixes the problem.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-18, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data