CVE-2020-26274: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-12-16T20:15Z
Repository: https://github.com/sebhildebrandt/systeminformation
Language: HTML
Files changed: CHANGELOG.md, docs/history.html, docs/index.html, docs/security.html, lib/util.js
Commit date: 2020-12-11 21:35:35 +0100
Commit message: inetLatency() command injection vulnaribility fix

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8a2bb3..832d04f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,10 +28,11 @@ For major (breaking) changes - version 3 and 2 see end of page.
 
 ## Version history
 
 | Version        | Date           | Comment  |
 | -------------- | -------------- | -------- |
+| 4.31.1         | 2020-12-11     | `inetLatency()` command injection vulnaribility fix |
 | 4.31.0         | 2020-12-06     | `osInfo()` added FQDN |
 | 4.30.11        | 2020-12-02     | `cpu()` bug fix speed parsing |
 | 4.30.10        | 2020-12-01     | `cpu()` handled speed parsing error (Apple Silicon) |
 | 4.30.9         | 2020-12-01     | `cpu()` corrected processor names (Raspberry Pi) |
 | 4.30.8         | 2020-11-30     | `fsSize()` catch error (mac OS) |
diff --git a/docs/history.html b/docs/history.html
index 3329992..1fb4dc9 100644
--- a/docs/history.html
+++ b/docs/history.html
@@ -81,10 +81,15 @@
                     <th scope="col">Date</th>
                     <th scope="col">Comment</th>
                   </tr>
                 </thead>
                 <tbody>
+                  <tr>
+                    <th scope="row">4.31.1</th>
+                    <td>2020-12-06</td>
+                    <td><span class="code">inetLatency()</span> command injection vulnaribility fix</td>
+                  </tr>
                   <tr>
                     <th scope="row">4.31.0</th>
                     <td>2020-12-06</td>
                     <td><span class="code">osInfo()</span> added FQDN</td>
                   </tr>
diff --git a/docs/index.html b/docs/index.html
index 83918cd..795a454 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -163,15 +163,15 @@
 </head>
 
 <body>
   <header class="bg-image-full">
     <div class="container">
-      <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.30.5</a>
+      <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.31.1</a>
       <img class="logo" src="assets/logo.png">
       <div class="title">systeminformation</div>
       <div class="subtitle"><span id="typed"></span></div>
-      <div class="version">Current Version: <span id="version">4.31.0</span></div>
+      <div class="version">Current Version: <span id="version">4.31.1</span></div>
       <button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
     </div>
     <div class="down">
       <button class="btn btn-primary mb-2" onclick="location.href='https://www.buymeacoffee.com/systeminfo'">Buy me a coffee&nbsp;&nbsp;<i class="far fa-mug-hot"></i></button>
       <br>Read Documentation<br>
diff --git a/docs/security.html b/docs/security.html
index 6b0b9f6..c0d09b5 100644
--- a/docs/security.html
+++ b/docs/security.html
@@ -40,10 +40,27 @@
       <div class="col-12 col-md-8 col-lg-9 col-xl-10 content">
         <div class="row">
           <div class="col-12 sectionheader">
             <div class="title">Security Advisories</div>
             <div class="text">
+              <h2>Command Injection Vulnerability</h2>
+              <p><span class="bold">Affected versions:</span>
+                < 4.31.1<br>
+                  <span class="bold">Date:</span> 2020-12-11<br>
+                  <span class="bold">CVE indentifier</span> (not yet)
+              </p>
+
+              <h4>Impact</h4>
+              <p>Here we had an issue that there was a possibility to inject commands to the command line of your machine via systeminformation. Affected commands: <span class="code">inetLatency()</span>.</p>
+
+              <h4>Patch</h4>
+              <p>Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1</p>
+
+              <h4>Workarround</h4>
+              <p>If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to <span class="code">inetLatency()</span></p>
+
+
               <h2>command injection vulnerability - prototype pollution</h2>
               <p><span class="bold">Affected versions:</span>
                 < 4.30.5<br>
                   <span class="bold">Date:</span> 2020-11-26<br>
                   <span class="bold">CVE indentifier</span> CVE-2020-26245
diff --git a/lib/util.js b/lib/util.js
index 205e574..1931a88 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -519,10 +519,12 @@ function sanitizeShellString(str) {
       s[i] === ']' ||
       s[i] === '#' ||
       s[i] === '\\' ||
       s[i] === '\t' ||
       s[i] === '\n' ||
+      s[i] === '\'' ||
+      s[i] === '`' ||
       s[i] === '"')) {
       result = result + s[i];
     }
   }
   return result;

Vulnerable code:       <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.30.5</a>
      <div class="version">Current Version: <span id="version">4.31.0</span></div>
Fixed code: | 4.31.1         | 2020-12-11     | `inetLatency()` command injection vulnaribility fix |
                  <tr>
                    <th scope="row">4.31.1</th>
                    <td>2020-12-06</td>
                    <td><span class="code">inetLatency()</span> command injection vulnaribility fix</td>
                  </tr>
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v4.31.1</a>
      <div class="version">Current Version: <span id="version">4.31.1</span></div>
              <h2>Command Injection Vulnerability</h2>
              <p><span class="bold">Affected versions:</span>
                < 4.31.1<br>
                  <span class="bold">Date:</span> 2020-12-11<br>
                  <span class="bold">CVE indentifier</span> (not yet)
              </p>

              <h4>Impact</h4>
              <p>Here we had an issue that there was a possibility to inject commands to the command line of your machine via systeminformation. Affected commands: <span class="code">inetLatency()</span>.</p>

              <h4>Patch</h4>
              <p>Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1</p>

              <h4>Workarround</h4>
              <p>If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to <span class="code">inetLatency()</span></p>


      s[i] === '\'' ||
      s[i] === '`' ||