CVE-2021-21315 System Information Library for Node.JS Command Injection

What is CVE-2021-21315?

CVE-2021-21315 is a high-severity vulnerability in sebhildebrandt systeminformation, published on 16 Feb 2021.

Official description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Weakness: CWE-78

Which versions are affected by CVE-2021-21315?

2 open source packages ship an affected version, including systeminformation. It affects 2 products.

Products include Apache Cordova, Systeminformation Systeminformation.

How do I fix CVE-2021-21315?

Upgrade systeminformation to 5.3.1 or later. US federal agencies must fix it by 1 Feb 2022.

Is CVE-2021-21315 being exploited?

Yes. Attackers have exploited CVE-2021-21315 in the wild since at least 18 Jan 2022.

Public exploit code: 1 Nuclei template and 6 proofs of concept on GitHub.

Other vulnerabilities in sebhildebrandt systeminformation

• CVE-2014-0073 Cross-site scripting in n/a Critical 9.8
• CVE-2014-0072 Security feature bypass in n/a High 7.5
• CVE-2016-6799 Information Exposure in cordova-android High 7.5
• CVE-2017-3160 Supply chain in Apache Cordova Android High 7.4
• CVE-2014-3500 Other in n/a Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2m8v-572m-ff2v.