CVE-2023-42810: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-09-21T18:15Z
Repository: https://github.com/sebhildebrandt/systeminformation
Language: HTML
Files changed: docs/history.html, docs/index.html, docs/security.html, lib/wifi.js
Commit date: 2023-09-19 17:39:39 +0200
Commit message: wifi sanitizing ssid names

Diff: diff --git a/docs/history.html b/docs/history.html
index dd361406..cc2ee289 100644
--- a/docs/history.html
+++ b/docs/history.html
@@ -55,10 +55,15 @@
                       <th scope="col" width="12%">Date</th>
                       <th scope="col">Comment</th>
                     </tr>
                   </thead>
                   <tbody>
+                    <tr>
+                      <th scope="row">5.21.7</th>
+                      <td>2023-09-19</td>
+                      <td><span class="code">wifiConnections()</span> <span class="code">wifiNetworks()</span>fixed security issue (linux)</td>
+                    </tr>
                     <tr>
                       <th scope="row">5.21.6</th>
                       <td>2023-09-18</td>
                       <td><span class="code">baseboard()</span> improved parsing (windows)</td>
                     </tr>
diff --git a/docs/index.html b/docs/index.html
index b36c0057..02507ff8 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -164,15 +164,15 @@
 </head>
 
 <body>
   <header class="bg-image-full">
     <div class="top-container">
-      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.6.13</a>
+      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.21.7</a>
       <img class="logo" src="assets/logo.png" alt="logo">
       <div class="title">systeminformation</div>
       <div class="subtitle"><span id="typed"></span>&nbsp;</div>
-      <div class="version">New Version: <span id="version">5.21.6</span></div>
+      <div class="version">New Version: <span id="version">5.21.7</span></div>
       <button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
     </div>
     <div class="down">
       <button class="btn btn-primary mb-2" onclick="location.href='https://www.buymeacoffee.com/systeminfo'">Buy me a coffee&nbsp;&nbsp;<i class="far fa-mug-hot"></i></button>
       <br>Read Documentation<br>
diff --git a/docs/security.html b/docs/security.html
index f83404b2..20168eaa 100644
--- a/docs/security.html
+++ b/docs/security.html
@@ -47,10 +47,28 @@
                 <h2>Passing User Paramters to Systeminformation</h2>
                 <p>For most of the applications that are using <span class="code">systeminformation</span>, there is no reason to worry. <span class="bold">But be aware!</span> If you are using <span class="code">inetLatency()</span>, <span class="code">inetChecksite()</span>, <span class="code">services()</span>, <span class="code">processLoad()</span>, <span class="code">versions()</span> with arbitrary untrusted user input, you should pay extra attention! We are doing a lot of input sanitation for those functions inside this package but we cannot handle all cases!</p>
                 <p class="warning">This can lead to serious impact on your servers!</p>
                 <p>We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing <span class="code">"systeminformation": "^4"</span> in your package.json (dependencies) and run <span class="code">npm install</span></p>
 
+                <h2>SSID Command Injection Vulnerability</h2>
+                <p><span class="bold">Affected versions:</span>
+                  &lt; 5.21.07 and &lt; 4.34.22<br>
+                  <span class="bold">Date:</span> 2023-09-19<br>
+                  <span class="bold">CVE indentifier</span> -
+                </p>
+
+                <h4>Impact</h4>
+                <p>We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span>.</p>
+
+                <h4>Patch</h4>
+                <p>Problem was fixed with parameter checking. Please upgrade to version >= 5.7.21 (or >= 4.34.22 if you are using version 4).</p>
+
+                <h4>Workaround</h4>
+                <p>If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span> (string only)</p>
+                <hr>
+                <br>
+
                 <h2>Command Injection Vulnerability</h2>
                 <p><span class="bold">Affected versions:</span>
                   &lt; 5.6.13 and &lt; 4.34.21<br>
                   <span class="bold">Date:</span> 2021-05-04<br>
                   <span class="bold">CVE indentifier</span> -
@@ -253,6 +271,6 @@
       createMenu();
     }
   </script>
 </body>
 
-</html>
\ No newline at end of file
+</html>
diff --git a/lib/wifi.js b/lib/wifi.js
index ea6a4f59..40626d42 100644
--- a/lib/wifi.js
+++ b/lib/wifi.js
@@ -547,11 +547,19 @@ function wifiConnections(callback) {
 
           const nmiDetails = nmiDeviceLinux(ifaceSanitized);
           const wpaDetails = wpaConnectionLinux(ifaceSanitized);
           const ssid = nmiDetails.ssid || wpaDetails.ssid;
           const network = networkList.filter(nw => nw.ssid === ssid);
-          const nmiConnection = nmiConnectionLinux(ssid);
+          let ssidSanitized = '';
+          const t = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ssid, true);
+          for (let i = 0; i <= util.mathMin(t.length, 2000); i++) {
+            if (t[i] !== undefined) {
+              ssidSanitized = ssidSanitized + t[i];
+            }
+          }
+
+          const nmiConnection = nmiConnectionLinux(ssidSanitized);
           const channel = network && network.length && network[0].channel ? network[0].channel : (wpaDetails.channel ? wpaDetails.channel : null);
           const bssid = network && network.length && network[0].bssid ? network[0].bssid : (wpaDetails.bssid ? wpaDetails.bssid : null);
           if (ssid && bssid) {
             result.push({
               id: ifaceDetail.id,

Vulnerable code:       <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.6.13</a>
      <div class="version">New Version: <span id="version">5.21.6</span></div>
</html>
          const nmiConnection = nmiConnectionLinux(ssid);
Fixed code:                     <tr>
                      <th scope="row">5.21.7</th>
                      <td>2023-09-19</td>
                      <td><span class="code">wifiConnections()</span> <span class="code">wifiNetworks()</span>fixed security issue (linux)</td>
                    </tr>
      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.21.7</a>
      <div class="version">New Version: <span id="version">5.21.7</span></div>
                <h2>SSID Command Injection Vulnerability</h2>
                <p><span class="bold">Affected versions:</span>
                  &lt; 5.21.07 and &lt; 4.34.22<br>
                  <span class="bold">Date:</span> 2023-09-19<br>
                  <span class="bold">CVE indentifier</span> -
                </p>

                <h4>Impact</h4>
                <p>We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span>.</p>

                <h4>Patch</h4>
                <p>Problem was fixed with parameter checking. Please upgrade to version >= 5.7.21 (or >= 4.34.22 if you are using version 4).</p>

                <h4>Workaround</h4>
                <p>If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span> (string only)</p>
                <hr>
                <br>

</html>
          let ssidSanitized = '';
          const t = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ssid, true);
          for (let i = 0; i <= util.mathMin(t.length, 2000); i++) {
            if (t[i] !== undefined) {
              ssidSanitized = ssidSanitized + t[i];
            }
          }

          const nmiConnection = nmiConnectionLinux(ssidSanitized);