CVE-2023-42810: Systeminformation RCE Vulnerability

CVE-2023-42810 Overview

CVE-2023-42810 is a critical command injection vulnerability affecting systeminformation, a popular System Information Library for Node.js. The vulnerability exists in versions 5.0.0 through 5.21.6 and allows attackers to inject malicious commands through SSID parameters passed to WiFi-related functions. This vulnerability poses a severe risk to applications that process untrusted WiFi network data without proper sanitization.

Critical Impact

Attackers can achieve remote code execution by injecting malicious commands through unsanitized SSID parameters in the wifiConnections() and wifiNetworks() functions, potentially leading to complete system compromise.

Affected Products

• systeminformation versions 5.0.0 through 5.21.6 for Node.js
• Applications using vulnerable wifiConnections() function
• Applications using vulnerable wifiNetworks() function with string parameters

Discovery Timeline

• 2023-09-19 - Security patch released in version 5.21.7
• 2023-09-21 - CVE-2023-42810 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-42810

Vulnerability Analysis

This command injection vulnerability (CWE-77) exists in the systeminformation library's WiFi functionality on Linux systems. The vulnerable functions wifiConnections() and wifiNetworks() fail to properly sanitize SSID name parameters before using them in system command execution. When an application passes untrusted input to these functions, an attacker can craft malicious SSID strings containing shell metacharacters that escape the intended command context and execute arbitrary commands on the underlying operating system.

The vulnerability is particularly dangerous because WiFi SSID names are often sourced from external, untrusted environments—such as scanning nearby networks or processing user input. Applications that blindly pass this data to the systeminformation library without validation are vulnerable to exploitation.

Root Cause

The root cause of CVE-2023-42810 is improper input validation in the wifiConnections() and wifiNetworks() functions. The library directly incorporates SSID parameters into shell commands without sanitizing shell metacharacters such as semicolons, backticks, pipes, or command substitution syntax. This allows attackers to break out of the intended command context and inject arbitrary commands that execute with the privileges of the Node.js process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious WiFi SSID containing shell injection payloads
2. Having an application scan or connect to networks, capturing the malicious SSID
3. The malicious SSID is passed to vulnerable wifiConnections() or wifiNetworks() functions
4. The injected commands execute on the server with the application's privileges

The fix implemented in version 5.21.7 adds parameter validation to sanitize SSID names before command execution:

                     </tr>
                   </thead>
                   <tbody>
+                    <tr>
+                      <th scope="row">5.21.7</th>
+                      <td>2023-09-19</td>
+                      <td><span class="code">wifiConnections()</span> <span class="code">wifiNetworks()</span>fixed security issue (linux)</td>
+                    </tr>
                     <tr>
                       <th scope="row">5.21.6</th>
                       <td>2023-09-18</td>

Source: GitHub Commit Update

Detection Methods for CVE-2023-42810

Indicators of Compromise

• Unexpected child process spawning from Node.js applications utilizing systeminformation
• Anomalous shell commands executed in the context of web applications or Node.js services
• Log entries showing malformed SSID names containing shell metacharacters (;, |, `, $())
• Unusual network connections or data exfiltration from Node.js processes

Detection Strategies

• Monitor Node.js application logs for unusual command execution patterns or errors related to WiFi functions
• Implement application-level logging around calls to wifiConnections() and wifiNetworks() to capture input parameters
• Use runtime application self-protection (RASP) solutions to detect command injection attempts
• Deploy SentinelOne Singularity to detect and prevent malicious command execution from Node.js processes

Monitoring Recommendations

• Enable process monitoring to detect unexpected shell commands spawned by Node.js applications
• Configure alerts for network reconnaissance activities from application servers
• Review dependency manifests (package.json and package-lock.json) to identify vulnerable systeminformation versions
• Implement Software Composition Analysis (SCA) in CI/CD pipelines to catch vulnerable dependencies before deployment

How to Mitigate CVE-2023-42810

Immediate Actions Required

• Upgrade systeminformation to version 5.21.7 or later immediately
• Audit all codepaths that call wifiConnections() or wifiNetworks() functions
• Implement input validation and sanitization for any SSID parameters before passing to the library
• Review application logs for any historical evidence of exploitation attempts

Patch Information

The vulnerability was fixed in systeminformation version 5.21.7 released on 2023-09-19. The patch adds parameter validation to sanitize SSID names before they are used in system commands. Organizations should update their package.json to require "systeminformation": ">=5.21.7" and run npm update to apply the fix.

For detailed information about the security fix, refer to the GitHub Security Advisory and the System Information Security Overview.

Workarounds

• Implement strict input validation for any strings passed to wifiConnections() and wifiNetworks() functions
• Sanitize SSID parameters by removing or escaping shell metacharacters before function calls
• Consider disabling WiFi-related functionality if not essential to application operations
• Isolate applications using systeminformation in sandboxed environments with limited system privileges

# Update systeminformation to patched version
npm update systeminformation

# Verify installed version is 5.21.7 or higher
npm list systeminformation

# Check for vulnerable versions in project dependencies
npm audit