systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.33.14
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The systeminformation Node.js library, a package for retrieving system and OS information, is affected on Linux when its network statistics function is called with an attacker-influenced interface name. An attacker who can both supply that input and set up files on the local system could use path traversal and symbolic links to read the first line of arbitrary files the Node.js process can access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- sebhildebrandt systeminformation
fixed in 5.33.14
- systeminformationnpm
fixed in 5.33.14