CVE-2020-26245
📋 TL;DR
This vulnerability in the systeminformation npm package allows attackers to execute arbitrary commands on affected systems through prototype pollution. It affects applications using vulnerable versions of the package that call the si.inetChecksite() function with untrusted input. Developers using this package in Node.js applications are at risk.
💻 Affected Systems
- systeminformation npm package
📦 What is this software?
Systeminformation by Systeminformation
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Limited command execution within the application's context, potentially leading to data theft, service disruption, or lateral movement.
If Mitigated
No impact if input validation prevents malicious payloads from reaching the vulnerable function.
🎯 Exploit Status
Exploitation requires the application to call the vulnerable function with attacker-controlled input.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.30.5 and later
Vendor Advisory: https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg
Restart Required: Yes
Instructions:
1. Update package.json to require systeminformation >=4.30.5
2. Run 'npm update systeminformation'
3. Restart your Node.js application
🔧 Temporary Workarounds
Input validation for si.inetChecksite()
allValidate and sanitize all parameters passed to si.inetChecksite() function
🧯 If You Can't Patch
- Implement strict input validation for all parameters passed to si.inetChecksite() function
- Remove or disable usage of si.inetChecksite() if not essential
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list systeminformation' to see installed versionCheck Version:
npm list systeminformation | grep systeminformationVerify Fix Applied:
Confirm systeminformation version is 4.30.5 or higher using 'npm list systeminformation'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns
- Unexpected network connections from Node.js processes
- Errors from systeminformation package
Network Indicators:
- Unexpected outbound connections from application servers
- Suspicious DNS queries
SIEM Query:
process.name:node AND cmdline:*inetChecksite* AND (cmdline:*;* OR cmdline:*&* OR cmdline:*|*)🔗 References
- https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg
- https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg
