Command Injection Vulnerability
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 7.1epss 91%
de la publicación al arma13 días
Publicada en NVD16 feb
1ª PoC+13d
CISA KEV+336d
probabilidad de explotación
91%top 1% de las CVE
explotación observada
síCISA + VulnCheck
8 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2022-02-01
Apply updates per vendor instructions.
Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Productos afectados
sebhildebrandt · systeminformationPoCs públicas encontradas — 8
githubgithub.com/ForbiddenProgrammer/CVE-2021-21315-PoC★ 160githubgithub.com/alikarimi999/CVE-2021-21315★ 4githubgithub.com/G01d3nW01f/CVE-2021-21315★ 1githubgithub.com/MazX0p/CVE-2021-21315-exploit★ 0githubgithub.com/xMohamed0/CVE-2021-21315-POC★ 0vulncheckvulncheck.com/xdb/103f055d687bno verificadovulncheckvulncheck.com/xdb/b335b010d8f4no verificadovulncheckvulncheck.com/xdb/82d28479bdcbno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2vhttps://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20210312-0007/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315https://www.npmjs.com/package/systeminformation