Log in Start free

Actively exploited · Published Feb 16, 2021 · Assigned by GitHub_M

CVE-2021-21315Command Injection Vulnerability

High 7.1 Exploited

In plain English

A high-severity OS command injection in systeminformation from sebhildebrandt. Attackers are actively exploiting it in the wild (listed by CISA on January 18, 2022). The chance it is exploited in the next 30 days is estimated at 90.7% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)90.7%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Jan 18, 2022
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Feb 1, 2022.

Official description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14node-systeminformationno fix listedDEBIAN-CVE-2021-21315
npmsysteminformation5.3.1GHSA-2m8v-572m-ff2v

Affected products (as reported)

VendorProductVersions
sebhildebrandt systeminformation < 5.3.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References