Node.js systeminformation Package Vulnerability Exposes Millions of Systems to RCE Attacks

A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions of systems to potential remote code execution (RCE) and privilege escalation attacks.

The vulnerability, assigned CVE-2024-56334, highlights the importance of secure coding practices when dealing with untrusted user input.

The vulnerability resides in the getWindowsIEEE8021x function of the systeminformation package, specifically affecting versions ≤5.23.6.

The issue stems from inadequate sanitization of the Wi-Fi SSID field, which is passed directly as a parameter to Windows’ cmd.exe. This allows attackers to inject malicious payloads that can be executed as operating system commands.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

Details of the Vulnerability

According to the GitHub reports, the flaw was discovered in how the SSID is obtained and processed.

The SSID is retrieved using the netsh wlan show interface command and subsequently passed to cmd.exe /d /s /c “netsh wlan show profiles”.

The SSID field is not sanitized before being passed to the command, allowing attackers to craft malicious SSID names that can execute arbitrary commands on the victim’s system.

Proof of Concept (PoC)

The following steps demonstrate the vulnerability:

1. Crafting a Malicious SSID: An attacker can set the SSID of a hotspot to include a command injection payload, such as:
   • a” | ping /t 127.0.0.1 &
   • a” | %SystemDrive%\a\a.exe &
2. Connecting to the Malicious Network: The victim connects to the malicious SSID using a vulnerable system.
3. Executing the Exploit: The attacker executes the vulnerable function via the package:

const si = require('systeminformation');

si.networkInterfaces((net) => { console.log(net) });

This exploit enables the execution of arbitrary commands, such as running executables or creating an indefinite ping loop.

Affected and Patched Versions

Here are the affected and patched versions of the systeminformation package presented in a table format for better clarity:

Version Status	Version	Details
Affected Versions	≤ 5.23.6	Vulnerable to the command injection flaw.
Patched Version	5.23.7	Vulnerability fixed; sanitization implemented.

The impact of the vulnerability is severe and poses significant security risks. Exploiting this flaw can enable remote code execution (RCE) or local privilege escalation, depending on how the systeminformation package is used within an application.

By injecting malicious commands through a specially crafted Wi-Fi SSID, attackers can execute arbitrary commands, potentially gaining unauthorized access to systems, exfiltrating sensitive data, or disrupting operations.

The vulnerability compromises the confidentiality, integrity, and availability of the affected systems, with a CVSS v3 base score of 10.0 (High) indicating the critical nature of the issue. Developers must act swiftly to patch their systems and prevent potential exploitation.

The vulnerability was reported by security researcher @xAiluros, who documented the issue and the proof of concept.

The author of the package, sebhildebrandt, quickly addressed the issue by releasing a patched version. Developers relying on the systeminformation package should act promptly to secure their systems against this critical flaw.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free