CVE-2020-7752: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2020-10-26T17:15Z
Repository: https://github.com/sebhildebrandt/systeminformation
Language: HTML
Files changed: CHANGELOG.md, docs/history.html, docs/index.html, lib/internet.js
Commit date: 2020-10-26 10:53:59 +0100
Commit message: inetChecksite() fixed vulnerability: command injection

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e95ea8..dfc3eb0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -28,10 +28,11 @@ For major (breaking) changes - version 3 and 2 see end of page.
 
 ## Version history
 
 | Version        | Date           | Comment  |
 | -------------- | -------------- | -------- |
+| 4.27.11        | 2020-10-26     | `inetChecksite()` fixed vulnerability: command injection |
 | 4.27.10        | 2020-10-16     | `dockerContainers()` resolved hanging issue |
 | 4.27.9         | 2020-10-13     | `networkInterfaces()` loopback internal detection (windows) |
 | 4.27.8         | 2020-10-08     | windows codepages partial fix |
 | 4.27.7         | 2020-10-05     | updated typescript typings, minor fixes |
 | 4.27.6         | 2020-10-02     | `get()` fixed when results are in arrays |
diff --git a/docs/history.html b/docs/history.html
index 05c9067..da01d35 100644
--- a/docs/history.html
+++ b/docs/history.html
@@ -81,10 +81,15 @@
                     <th scope="col">Date</th>
                     <th scope="col">Comment</th>
                   </tr>
                 </thead>
                 <tbody>
+                  <tr>
+                    <th scope="row">4.27.11</th>
+                    <td>2020-10-26</td>
+                    <td><span class="code">inetChecksite()</span> fixed vulnerability: command injection</td>
+                  </tr>
                   <tr>
                     <th scope="row">4.27.10</th>
                     <td>2020-10-16</td>
                     <td><span class="code">dockerContainers()</span> resolved hanging issue</td>
                   </tr>
diff --git a/docs/index.html b/docs/index.html
index 1a843ac..ba2af03 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -166,11 +166,11 @@
   <header class="bg-image-full">
     <div class="container">
       <img class="logo" src="assets/logo.png">
       <div class="title">systeminformation</div>
       <div class="subtitle"><span id="typed"></span></div>
-      <div class="version">Current Version: <span id="version">4.27.10</span></div>
+      <div class="version">Current Version: <span id="version">4.27.11</span></div>
       <button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
     </div>
     <div class="down">
       <button class="btn btn-primary mb-2" onclick="location.href='https://www.buymeacoffee.com/systeminfo'">Buy me a coffee&nbsp;&nbsp;<i class="far fa-mug-hot"></i></button>
       <br>Read Documentation<br>
diff --git a/lib/internet.js b/lib/internet.js
index 414ef75..ac81e36 100644
--- a/lib/internet.js
+++ b/lib/internet.js
@@ -32,11 +32,17 @@ const _sunos = (_platform === 'sunos');
 function inetChecksite(url, callback) {
 
   return new Promise((resolve) => {
     process.nextTick(() => {
 
-      const urlSanitized = util.sanitizeShellString(url).toLowerCase();
+      let urlSanitized = util.sanitizeShellString(url).toLowerCase();
+      urlSanitized = urlSanitized.replace(/ /g, '');
+      urlSanitized = urlSanitized.replace(/\$/g, '');
+      urlSanitized = urlSanitized.replace(/\(/g, '');
+      urlSanitized = urlSanitized.replace(/\)/g, '');
+      urlSanitized = urlSanitized.replace(/{/g, '');
+      urlSanitized = urlSanitized.replace(/}/g, '');
       let result = {
         url: urlSanitized,
         ok: false,
         status: 404,
         ms: -1

Vulnerable code:       <div class="version">Current Version: <span id="version">4.27.10</span></div>
      const urlSanitized = util.sanitizeShellString(url).toLowerCase();
Fixed code: | 4.27.11        | 2020-10-26     | `inetChecksite()` fixed vulnerability: command injection |
                  <tr>
                    <th scope="row">4.27.11</th>
                    <td>2020-10-26</td>
                    <td><span class="code">inetChecksite()</span> fixed vulnerability: command injection</td>
                  </tr>
      <div class="version">Current Version: <span id="version">4.27.11</span></div>
      let urlSanitized = util.sanitizeShellString(url).toLowerCase();
      urlSanitized = urlSanitized.replace(/ /g, '');
      urlSanitized = urlSanitized.replace(/\$/g, '');
      urlSanitized = urlSanitized.replace(/\(/g, '');
      urlSanitized = urlSanitized.replace(/\)/g, '');
      urlSanitized = urlSanitized.replace(/{/g, '');
      urlSanitized = urlSanitized.replace(/}/g, '');