CVE-2024-56334 Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
Attackers can execute arbitrary OS commands via unsanitized SSID input in the systeminformation library, potentially leading to remote code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-56334?
CVE-2024-56334 is a high-severity command injection vulnerability in sebhildebrandt systeminformation, published on 20 Dec 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2024-56334?
2 open source packages ship an affected version, including systeminformation.
| Package | Affected | Fixed in |
|---|---|---|
systeminformation npm | All versions | 5.23.7 |
systeminformation npm | All versions | 5.23.7 |
How do I fix CVE-2024-56334?
Upgrade systeminformation to 5.23.7 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-56334 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-56334 exists.
Sources
Also known as DEBIAN-CVE-2024-56334, GHSA-cvv5-9h9w-qp2m, UBUNTU-CVE-2024-56334.