⚠ Actively exploited
Added to CISA KEV on 2022-01-18. Federal agencies required to patch by 2022-02-01. Required action: Apply updates per vendor instructions..

CVE-2021-21315

CWE-78 — OS Command Injection9 documents9 sources
Severity
7.8HIGH
EPSS
94.0%
top 0.11%
CISA KEV
KEV
Added 2022-01-18
Due 2022-02-01
Exploit
Exploited in wild
Active exploitation observed
Affected products
3
Sebhildebrandt SysteminformationSysteminformation SysteminformationApache Cordova
Timeline
PublishedFeb 16
KEV addedJan 18
KEV dueFeb 1
Latest updateJul 21
CISA Required Action: Apply updates per vendor instructions.

Description

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings,…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NExploitability: 2.5 | Impact: 4.0

Affected Packages4 packages

▶npmsysteminformation< 5.3.1
▶NVDapache/cordova10.0.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
CVEList
Command Injection Vulnerability↗2021-02-16
▶
OSV
Command Injection Vulnerability↗2021-02-16
▶
GHSA
Command Injection Vulnerability↗2021-02-16
▶
VulnCheck
System Information Library for Node.JS Command Injection↗2021
▶

💥Exploits & PoCs

1
Nuclei
Node.JS System Information Library <5.3.1 - Remote Command Injection
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT NodeJS System Information Library Command Injection Attempt (CVE-2021-21315)↗2022-01-25
▶

📋Vendor Advisories

1
CISA
System Information Library for Node.JS Command Injection↗2022-01-18
▶

🕵️Threat Intelligence

1
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report↗2022-07-21
▶
CVE-2021-21315 (HIGH CVSS 7.8) | The System Information Library for | cvebase.io