CVE-2023-42810 (published 2023-09-21T18:15Z)

systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-77
cwe_name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
extended_description: 
            Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
         
         

Fix information:
repo_url: https://github.com/sebhildebrandt/systeminformation
commit_details: repo_url: https://github.com/sebhildebrandt/systeminformation
author: Sebastian Hildebrandt
author_date: 2023-09-19 17:39:39+02:00
msg: wifi sanitizing ssid names
repository: repo_url: https://github.com/sebhildebrandt/systeminformation
repo_name: sebhildebrandt/systeminformation
description: System Information Library for Node.JS
repo_language: JavaScript
owner: sebhildebrandt
file_changes: filename: history.html
change_type: ModificationType.MODIFY
diff: @@ -57,6 +57,11 @@
                     </tr>
                   </thead>
                   <tbody>
+                    <tr>
+                      <th scope="row">5.21.7</th>
+                      <td>2023-09-19</td>
+                      <td><span class="code">wifiConnections()</span> <span class="code">wifiNetworks()</span>fixed security issue (linux)</td>
+                    </tr>
                     <tr>
                       <th scope="row">5.21.6</th>
                       <td>2023-09-18</td>

programming_language: HTML
filename: index.html
change_type: ModificationType.MODIFY
diff: @@ -166,11 +166,11 @@
 <body>
   <header class="bg-image-full">
     <div class="top-container">
-      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.6.13</a>
+      <a href="security.html" class="recommendation">Security advisory:<br>Update to v5.21.7</a>
       <img class="logo" src="assets/logo.png" alt="logo">
       <div class="title">systeminformation</div>
       <div class="subtitle"><span id="typed"></span>&nbsp;</div>
-      <div class="version">New Version: <span id="version">5.21.6</span></div>
+      <div class="version">New Version: <span id="version">5.21.7</span></div>
       <button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
     </div>
     <div class="down">

programming_language: HTML
filename: security.html
change_type: ModificationType.MODIFY
diff: @@ -49,6 +49,24 @@
                 <p class="warning">This can lead to serious impact on your servers!</p>
                 <p>We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing <span class="code">"systeminformation": "^4"</span> in your package.json (dependencies) and run <span class="code">npm install</span></p>
 
+                <h2>SSID Command Injection Vulnerability</h2>
+                <p><span class="bold">Affected versions:</span>
+                  &lt; 5.21.07 and &lt; 4.34.22<br>
+                  <span class="bold">Date:</span> 2023-09-19<br>
+                  <span class="bold">CVE indentifier</span> -
+                </p>
+
+                <h4>Impact</h4>
+                <p>We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span>.</p>
+
+                <h4>Patch</h4>
+                <p>Problem was fixed with parameter checking. Please upgrade to version >= 5.7.21 (or >= 4.34.22 if you are using version 4).</p>
+
+                <h4>Workaround</h4>
+                <p>If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to <span class="code">wifiConnections()</span>, <span class="code">wifiNetworks()</span> (string only)</p>
+                <hr>
+                <br>
+
                 <h2>Command Injection Vulnerability</h2>
                 <p><span class="bold">Affected versions:</span>
                   &lt; 5.6.13 and &lt; 4.34.21<br>
@@ -255,4 +273,4 @@
   </script>
 </body>
 
-</html>
\ No newline at end of file
+</html>

programming_language: HTML
filename: wifi.js
change_type: ModificationType.MODIFY
diff: @@ -549,7 +549,15 @@ function wifiConnections(callback) {
           const wpaDetails = wpaConnectionLinux(ifaceSanitized);
           const ssid = nmiDetails.ssid || wpaDetails.ssid;
           const network = networkList.filter(nw => nw.ssid === ssid);
-          const nmiConnection = nmiConnectionLinux(ssid);
+          let ssidSanitized = '';
+          const t = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(ssid, true);
+          for (let i = 0; i <= util.mathMin(t.length, 2000); i++) {
+            if (t[i] !== undefined) {
+              ssidSanitized = ssidSanitized + t[i];
+            }
+          }
+
+          const nmiConnection = nmiConnectionLinux(ssidSanitized);
           const channel = network && network.length && network[0].channel ? network[0].channel : (wpaDetails.channel ? wpaDetails.channel : null);
           const bssid = network && network.length && network[0].bssid ? network[0].bssid : (wpaDetails.bssid ? wpaDetails.bssid : null);
           if (ssid && bssid) {

programming_language: JavaScript