Description

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

Remediation

References

https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909

https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js

https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61

Related Vulnerabilities

CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-api

CVE-2021-40823 Vulnerability in npm package matrix-js-sdk

CVE-2022-26260 Vulnerability in npm package simple-plist

CVE-2008-6681 Vulnerability in maven package org.dojotoolkit:dojo

CVE-2020-35149 Vulnerability in npm package rxdb

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory