GHSA-wphj-fx3q-84ch: systeminformation has a Command Injection vulnerability in fsSize() function on Windows
SummaryThe `fsSize()` function in `systeminformation` is vulnerable to **OS Command Injection (CWE-78)** on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function.**Affected Platforms:** Windows only**CVSS Breakdown:****Attack Vector (AV:N):** Network - if used in a web application/API**Attack Complexity (AC:H):** High - requires application to pass user input to `fsSize()`**Privileges Required (PR:N):** None - no authentication required at library level**User Interaction (UI:N):** None**Scope (S:U):** Unchanged - executes within Node.js process context**Confidentiality/Integrity/Availability (C:H/I:H/A:H):** High impact if exploited**Note:** The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable.DetailsVulnerable Code Location**File:** `lib/filesystem.js`, **Line 197**The `drive` parameter is concatenated directly into the PowerShell command string without any sanitization.Why This Is a VulnerabilityThis is inconsistent with the security pattern used elsewhere in the codebase. Other functions properly sanitize user input using `util.sanitizeShellString()`:| File | Line | Function | Sanitization |
|------|------|----------|--------------|
| `lib/processes.js` | 141 | `services()` | ✅ `util.sanitizeShellString(srv)` |
| `lib/processes.js` | 1006 | `processLoad()` | ✅ `util.sanitizeShellString(proc)` |
| `lib/network.js` | 1253 | `networkStats()` | ✅ `util.sanitizeShellString(iface)` |
| `lib/docker.js` | 472 | `dockerContainerStats()` | ✅ `util.sanitizeShellString(containerIDs, true)` |
| `lib/filesystem.js` | 197 | `fsSize()` | ❌ **No sanitization** |The `sanitizeShellString()` function (defined at `lib/util.js:731`) removes dangerous characters like `;`, `&`, `|`, `$`, `` ` ``, `#`, etc., which would prevent command injection.PoCAttack ScenarioAn application exposes disk information via an API and passes user input to `si.fsSize()`:Exploitation**Normal Request:****Malicious Request (Command Injection):**Command Construction DemonstrationThe following demonstrates how commands are constructed with malicious input:**Normal usage:****With injection payload `C:; whoami #`:**PowerShell will execute:`Get-WmiObject Win32_logicaldisk | ... | where -property Caption -eq C:` (original command)`whoami` (injected command)Everything after `#` is commented outPoC ScriptPoC OutputAs shown, the attacker's commands are injected directly into the PowerShell command string.ImpactWho Is Affected?Applications running `systeminformation` on **Windows** that pass user-controlled input to `fsSize(drive)`Web applications, APIs, or CLI tools that accept drive letters from usersMonitoring dashboards that allow users to specify which drives to queryPotential Attack Scenarios**Remote Code Execution (RCE)** - Execute arbitrary commands with Node.js process privileges**Data Exfiltration** - Read sensitive files and exfiltrate data**Privilege Escalation** - If Node.js runs with elevated privileges**Lateral Movement** - Use the compromised system to attack internal network**Ransomware Deployment** - Download and execute malicious payloadsRecommended FixApply `util.sanitizeShellString()` to the `drive` parameter, consistent with other functions in the codebase:The `true` parameter enables strict mode which removes additional characters like spaces and parentheses.`systeminformation` thanks developers working on the project. The Systeminformation Project hopes this report helps improve the its security. Please systeminformation know if any additional information or clarification is needed.
CVSS v3.1: 8.1