Update dependency systeminformation to v5.23.8 [SECURITY] #224
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
from
14310d4 to
28dbc4e
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #224 +/- ##
=======================================
Coverage 98.65% 98.65%
=======================================
Files 51 51
Lines 1933 1933
Branches 513 513
=======================================
Hits 1907 1907
Misses 23 23
Partials 3 3 ☔ View full report in Codecov by Sentry. |
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
from
28dbc4e to
7484050
Compare
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
2 times, most recently
from
90719a8 to
3b3fcfe
Compare
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
from
3b3fcfe to
2de6232
Compare
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
2 times, most recently
from
770f535 to
2b43669
Compare
renovate
bot
force-pushed
the
renovate/npm-systeminformation-vulnerability
branch
from
2b43669 to
5c327bd
Compare
Contributor
Author
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update ( If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.12.6->5.23.8GitHub Vulnerability Alerts
CVE-2023-42810
Impact
SSID Command Injection Vulnerability
Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.21.7, Version 4 was not affected
Workarounds
If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only)
References
See also https://systeminformation.io/security.html
CVE-2024-56334
Summary
The SSID is not sanitized when before it is passed as a parameter to cmd.exe in the
getWindowsIEEE8021xfunction. This means that malicious content in the SSID can be executed as OS commands.Details
I have exploited this vulnerability in a Windows service using version 5.22.11 of the module, to escalate privileges (in an environment where I am authorized to do so). However, as far as I can see from the code, it is still present in master branch at time of writing, on line 403/404 of network.js.
The SSID is obtained from
netsh wlan show interface ...ingetWindowsWirelessIfaceSSID, and then passed tocmd.exe /d /s /c "netsh wlan show profiles ...ingetWindowsIEEE8021x, without sanitization.PoC
First, the command injection payload should be included in the connected Wi-Fi SSID. For example create hotspot on mobile phone or other laptop, set SSID to payload, connect to it with victim Windows system. Two example SSID's to demonstrate exploitation are below.
Demonstration to run ping command indefinitely:
Run executable with privileges of the user in which vulnerable function is executed. Chosen executable should should be placed in (assuming system drive is C):
C:\a\a.exe.Then, the vulnerable function can be executed on the victim system, for example, using:
Now the chosen command,
PING.exeora.exewill be run through the cmd.exe command line.Impact
This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation.
Release Notes
sebhildebrandt/systeminformation (systeminformation)
v5.23.8Compare Source
v5.23.6Compare Source
v5.23.5Compare Source
v5.23.4Compare Source
v5.23.3Compare Source
v5.23.2Compare Source
v5.23.1Compare Source
v5.23.0Compare Source
v5.22.11Compare Source
v5.22.10Compare Source
v5.22.9Compare Source
v5.22.8Compare Source
v5.22.7Compare Source
v5.22.6Compare Source
v5.22.5Compare Source
v5.22.4Compare Source
v5.22.3Compare Source
v5.22.2Compare Source
v5.22.1Compare Source
v5.22.0Compare Source
v5.21.25Compare Source
v5.21.24Compare Source
v5.21.23Compare Source
v5.21.22Compare Source
v5.21.21Compare Source
v5.21.20Compare Source
v5.21.19Compare Source
v5.21.18Compare Source
v5.21.17Compare Source
v5.21.16Compare Source
v5.21.15Compare Source
v5.21.14Compare Source
v5.21.13Compare Source
v5.21.12Compare Source
v5.21.11Compare Source
v5.21.10Compare Source
v5.21.9Compare Source
v5.21.8Compare Source
v5.21.7Compare Source
v5.21.6Compare Source
v5.21.5Compare Source
v5.21.4Compare Source
v5.21.3Compare Source
v5.21.2Compare Source
v5.21.1Compare Source
v5.21.0Compare Source
v5.20.0Compare Source
v5.19.1Compare Source
v5.19.0Compare Source
v5.18.15Compare Source
v5.18.14Compare Source
v5.18.13Compare Source
v5.18.12Compare Source
v5.18.11Compare Source
v5.18.10Compare Source
v5.18.9Compare Source
v5.18.8Compare Source
v5.18.7Compare Source
v5.18.6Compare Source
v5.18.5Compare Source
v5.18.4Compare Source
v5.18.3Compare Source
v5.18.2Compare Source
v5.18.1Compare Source
v5.18.0Compare Source
v5.17.17Compare Source
v5.17.16Compare Source
v5.17.15Compare Source
v5.17.14Compare Source
v5.17.13Compare Source
v5.17.12Compare Source
v5.17.11Compare Source
v5.17.10Compare Source
v5.17.9Compare Source
v5.17.8Compare Source
v5.17.7Compare Source
v5.17.6Compare Source
v5.17.5Compare Source
v5.17.4Compare Source
v5.17.3Compare Source
v5.17.2Compare Source
v5.17.1Compare Source
v5.17.0Compare Source
v5.16.9Compare Source
v5.16.8Compare Source
v5.16.7Compare Source
v5.16.6Compare Source
v5.16.5Compare Source
v5.16.4Compare Source
v5.16.3Compare Source
v5.16.2Compare Source
v5.16.1Compare Source
v5.16.0Compare Source
v5.15.1Compare Source
v5.15.0Compare Source
v5.14.4Compare Source
v5.14.3Compare Source
v5.14.2Compare Source
v5.14.1Compare Source
v5.14.0Compare Source
v5.13.5Compare Source
v5.13.4Compare Source
v5.13.3Compare Source
v5.13.2Compare Source
v5.13.1Compare Source
v5.13.0Compare Source
v5.12.15Compare Source
v5.12.14Compare Source
v5.12.13Compare Source
v5.12.12Compare Source
v5.12.11Compare Source
v5.12.10Compare Source
v5.12.9Compare Source
v5.12.8Compare Source
v5.12.7Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.