CVE-2021-21315: Systeminformation Command Injection RCE Flaw

CVE-2021-21315 Overview

CVE-2021-21315 is a command injection vulnerability in the System Information Library for Node.js (npm package systeminformation), an open source collection of functions to retrieve detailed hardware, system, and OS information. This vulnerability allows attackers to inject arbitrary commands through unsanitized input parameters passed to specific library functions, potentially leading to complete system compromise.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation enables attackers to execute arbitrary commands with the privileges of the Node.js application, potentially leading to full system compromise.

Affected Products

• systeminformation npm package versions prior to 5.3.1
• Apache Cordova version 10.0.0
• Any Node.js applications utilizing vulnerable versions of the systeminformation package

Discovery Timeline

• 2021-02-16 - CVE-2021-21315 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2021-21315

Vulnerability Analysis

The vulnerability exists in multiple functions within the systeminformation library that accept user-controlled input parameters. The affected functions include si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(). These functions fail to properly validate and sanitize input parameters before using them in system command execution contexts.

The core issue stems from the library accepting arrays as input parameters when only strings should be permitted. When an attacker passes a specially crafted array containing command injection payloads, the library incorrectly processes these values and executes them as shell commands. This allows attackers to break out of the intended command context and execute arbitrary commands on the underlying operating system.

Root Cause

The root cause is improper input validation (CWE-78: OS Command Injection) where the affected functions do not adequately sanitize user-supplied parameters before incorporating them into system commands. Specifically, the library fails to enforce string-only input and does not properly escape or sanitize array elements when they are passed to command execution routines. This allows attackers to inject command separators and additional commands that execute with the privileges of the Node.js process.

Attack Vector

The attack requires local access where an attacker can control input parameters passed to the vulnerable systeminformation functions. In typical deployment scenarios, this could occur through:

1. Web applications that expose system information endpoints accepting user input
2. APIs that allow users to specify service names, process names, or network targets
3. Internal tools where user-controlled data flows to systeminformation function calls

An attacker crafts a malicious array payload containing shell metacharacters and command sequences. When the vulnerable function processes this array, instead of treating it as a literal string value, the command interpreter executes the injected commands. The attack does not require authentication if the vulnerable function is exposed through an unauthenticated endpoint.

The vulnerability leverages the way Node.js child_process functions handle array arguments, allowing attackers to bypass string sanitization that might otherwise be in place for single string inputs.

Detection Methods for CVE-2021-21315

Indicators of Compromise

• Unusual command execution patterns originating from Node.js processes
• Process spawning from Node.js applications that execute shell commands with unexpected arguments
• Suspicious array-formatted parameters in application logs containing shell metacharacters like ;, |, &&, or backticks
• Network connections or file system modifications initiated by Node.js worker processes

Detection Strategies

• Monitor for anomalous child process spawning from Node.js applications, particularly shell invocations with command chaining characters
• Implement application-level logging to capture parameters passed to systeminformation functions
• Deploy endpoint detection rules to identify command injection patterns in process command lines
• Review npm dependency audits for the presence of systeminformation versions prior to 5.3.1

Monitoring Recommendations

• Configure SentinelOne to alert on command injection behavioral patterns from Node.js runtime processes
• Implement Software Composition Analysis (SCA) to continuously monitor for vulnerable npm packages in your application dependencies
• Enable detailed process creation auditing on systems running Node.js applications
• Monitor for unexpected outbound network connections from Node.js application servers

How to Mitigate CVE-2021-21315

Immediate Actions Required

• Upgrade the systeminformation npm package to version 5.3.1 or later immediately
• Audit all applications using systeminformation to identify vulnerable deployments
• Implement input validation at the application layer to reject array parameters for affected functions
• Review application code for instances where user input flows to systeminformation function calls

Patch Information

The vulnerability was fixed in systeminformation version 5.3.1. The patch implements proper input validation to ensure that only string parameters are accepted by the affected functions, preventing array-based command injection attacks. The fix can be reviewed in the GitHub commit.

Organizations should update their package.json to specify the minimum safe version and run npm update systeminformation to apply the fix. For additional details, refer to the GitHub Security Advisory.

Workarounds

• If upgrading is not immediately possible, implement application-level input sanitization to ensure parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad() are strictly strings
• Reject any array inputs at the application boundary before passing data to systeminformation functions
• Apply a strict allowlist for acceptable input values where possible, limiting parameters to known-safe service names or hosts
• Consider isolating Node.js applications running vulnerable versions in containers with restricted privileges until patching is complete

# Update systeminformation to patched version
npm update systeminformation

# Verify installed version is 5.3.1 or later
npm list systeminformation

# Audit for vulnerable packages
npm audit