高危

Node.JS System Information Library操作系统命令注入漏洞

2021-02-14 14:17:36 公开，2025-10-23 00:50:00 更新

关键漏洞
CISA KEV
勒索软件漏洞
APT漏洞
本地
CWE Top 25 (2023)
公开PoC
无需认证
开源组件漏洞
2024两高一弱互联网漏洞
2024两高一弱内网漏洞
CWE Top 25 (2024)
2025两高一弱漏洞

CWEs：: CWE-78 （OS Command Injection）
SSVC：: 可利用状态：已被积极利用攻击自动化：否技术影响评估：部分 2025-02-07 03:38:40

风险信息

CVSS v2 向量: AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS v2 风险值: 4.6
CVSS v3 向量: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3 风险值: 7.8
CVSS v3.1 向量: AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v3.1 风险值: 7.1

详细信息

漏洞类型: 命令注入
漏洞描述: System Information Library for Node.JS可能允许远程攻击者在系统上执行任意命令，这是由解析服务参数时的命令注入缺陷造成的。通过发送精心编制的输入，攻击者可以利用此漏洞在系统上执行任意命令。
修复建议: 升级至systeminformation的最新版本（5.3.1或更高版本），可从systeminformation GIT Repository获得： https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v

参考链接

https://www.npmjs.com/package/systeminformation
OSV · x_refsource_MISC
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
OSV · x_refsource_CONFIRM
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E
OSV
https://security.netapp.com/advisory/ntap-20210312-0007/
OSV · x_refsource_CONFIRM
https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
OSV · x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2021-21315
OSV
https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
OSV · mailing-list · x_refsource_MLIST
https://github.com/advisories/GHSA-2m8v-572m-ff2v
https://security.netapp.com/advisory/ntap-20210312-0007
OSV · Third Party Advisory
https://osv.dev/vulnerability/GHSA-2m8v-572m-ff2v
OSV
https://osv.dev/vulnerability/CVE-2021-21315
OSV
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
NVD
https://github.com/sebhildebrandt/systeminformation
OSV