CVE-2021-21315

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525	Patch
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v	Third Party Advisory
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E	Issue Tracking Mailing List
https://security.netapp.com/advisory/ntap-20210312-0007/	Third Party Advisory
https://www.npmjs.com/package/systeminformation	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

cpe:2.3:a:apache:cordova:10.0.0:*:*:*:*:-:*:*

History

No history.

Information

Published : 2021-02-16 17:15

Updated : 2024-07-24 16:45

NVD link : CVE-2021-21315

Mitre link : CVE-2021-21315

CVE.ORG link : CVE-2021-21315

JSON object : View

Products Affected

apache

cordova

systeminformation

systeminformation

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2021-21315", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.5}]}, "published": "2021-02-16T17:15:13.050", "references": [{"url": "https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E", "tags": ["Issue Tracking", "Mailing List"], "source": "security-advisories@github.com"}, {"url": "https://security.netapp.com/advisory/ntap-20210312-0007/", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.npmjs.com/package/systeminformation", "tags": ["Product"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The System Information Library for Node.JS (npm package \"systeminformation\") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected."}, {"lang": "es", "value": "La Biblioteca System Information para Node.JS (paquete npm \"systeminformation\") es una colecci\u00f3n de funciones de c\u00f3digo abierto para recuperar informaci\u00f3n detallada sobre el hardware, el sistema y el SO. En systeminformation versiones anteriores a 5.3.1, se presenta una vulnerabilidad de inyecci\u00f3n de comandos. El problema se ha corregido en la versi\u00f3n 5.3.1. Como soluci\u00f3n en lugar de actualizar, aseg\u00farese de comprobar o sanear los par\u00e1metros de servicio que son pasados a las funciones si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... s\u00f3lo permiten cadenas, rechazan cualquier matriz. El saneamiento de cadenas funciona como se esperaba"}], "lastModified": "2024-07-24T16:45:54.860", "cisaActionDue": "2022-02-01", "cisaExploitAdd": "2022-01-18", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "52B945D4-063D-4674-9AF0-12AD903B3B55", "versionEndExcluding": "5.3.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:cordova:10.0.0:*:*:*:*:-:*:*", "vulnerable": true, "matchCriteriaId": "480219C3-0BEA-4B50-979E-88EA4E8F1DD3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "System Information Library for Node.JS Command Injection"}