FlagThis

A critical command injection vulnerability, identified as CVE-2024-56334, has been discovered in the widely-used Node.js ‘systeminformation’ package, potentially exposing millions of systems to remote code execution (RCE) attacks and privilege escalation. The vulnerability lies within the `getWindowsIEEE8021x` function, which retrieves network SSID information. This function fails to sanitize the SSID properly before passing it as a parameter to `cmd.exe`. Attackers can embed malicious commands within the SSID of a Wi-Fi network that would then be executed on a vulnerable system when this function is called, demonstrating how an improperly sanitized SSID can be used to inject system commands.

The flaw affects versions of ‘systeminformation’ up to and including 5.23.6. A proof of concept demonstrated that by connecting to a malicious Wi-Fi hotspot, attackers can execute arbitrary operating system commands on vulnerable machines, including initiating an indefinite ping loop or executing a malicious file. The maintainers of the package have released version 5.23.7, which addresses the vulnerability with sanitization. All users are strongly urged to update to the latest version immediately to mitigate the risk of RCE or privilege escalation attacks.

ImgSrc: blogger.googleusercontent.com

References:

• GBHackers Security | #1 Globally Trusted Cyber Security News Platform - A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions of systems to potential remote code execution (RCE) and privilege - 6d
• Vulnerability Archives ? Cybersecurity News - A severe command injection vulnerability (CVE-2024-56334) has been identified in the widely used Node.js system information package, which has over 8 million monthly downloads and a staggering 330 mil - 6d

Classification:

• HashTags: Nodejs RCE Systeminformation
• Company: Node.js
• Target: Node.js systems
• Product: systeminformation
• Feature: Command Injection
• Type: Vulnerability
• Severity: Major