CVE-2021-21315
System Information Library for Node.JS Command Injection
Description
CVE-2021-21315 is a high-severity OS command injection vulnerability in the System Information Library for Node.js (npm package "systeminformation"). The vulnerability allows an attacker to send a malicious payload that exploits the name parameter in several functions, enabling remote command execution on the target system. Versions of systeminformation prior to 5.3.1 are affected, along with Apache Cordova 10.0.0 which depends on the vulnerable package. CISA has added CVE-2021-21315 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 93.76% (99.85th percentile), this command injection vulnerability presents a near-certain exploitation risk.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| systeminformation | systeminformation | < 5.3.1 |
| apache | cordova | 10.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525(Patch)
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v(Third Party Advisory)
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E(Issue Tracking, Mailing List)
- https://security.netapp.com/advisory/ntap-20210312-0007/(Third Party Advisory)
- https://www.npmjs.com/package/systeminformation(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
OS Command Injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2021-21315, the systeminformation library fails to properly sanitize user-controlled input passed to functions like si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), allowing attackers to inject shell metacharacters and execute arbitrary OS commands with the privileges of the Node.js application.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Impact Analysis
CVE-2021-21315 carries a CVSS 3.1 score of 7.8 (HIGH) from NVD, indicating a serious threat. While the attack vector is local, the attack complexity is low and no user interaction is required. The scope is changed in the vendor assessment (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C), meaning successful exploitation can affect resources beyond the vulnerable component itself. The NVD primary assessment rates confidentiality, integrity, and availability impacts all as HIGH, indicating that an attacker can fully compromise the system running the vulnerable Node.js application. The EPSS score of 93.76% (99.85th percentile) indicates near-certain exploitation activity. As a widely used npm package, systeminformation is a dependency in many Node.js applications, broadening the potential attack surface significantly across the Node.js ecosystem.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2021-21315 in the wild by listing it in the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-02-01. The EPSS score of 93.76% (99.85th percentile) indicates near-certain exploitation activity. While the NVD references do not include entries tagged as public exploits, the vulnerability affects a widely used npm package with well-documented attack vectors through parameter injection in library functions, lowering the barrier to exploitation. The availability of a detailed GitHub Security Advisory at GHSA-2m8v-572m-ff2v provides sufficient technical detail for attackers to develop exploits.
Remediation
- Upgrade systeminformation to version 5.3.1 or later as required by CISA KEV directive. This version patches the command injection vulnerability by properly sanitizing input parameters.
- Audit all Node.js applications in your environment for dependencies on the systeminformation package. Check package-lock.json or yarn.lock files for systeminformation versions prior to 5.3.1, and update Apache Cordova from version 10.0.0 if present.
- Implement input validation as a workaround if immediate upgrading is not possible. Ensure that service parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad() only accept strings and reject any arrays. Apply strict string sanitization to all input values before passing them to these functions.
- Run Node.js applications with minimal privileges to limit the impact of command injection. Use dedicated service accounts with restricted permissions, implement containerization to isolate applications, and apply the principle of least privilege to file system and network access.
- Monitor for indicators of compromise by reviewing application logs and system process activity for unexpected command execution. Look for unusual child processes spawned by the Node.js application, unexpected network connections, and file system modifications outside the application directory.
Technical Details
CVE-2021-21315 is an OS command injection vulnerability (CWE-78) in the systeminformation npm package for Node.js. The vulnerability exists because several functions in the library, including si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad(), construct OS commands using user-supplied input without proper sanitization of shell metacharacters. An attacker can pass arrays instead of expected string parameters to bypass basic validation and inject arbitrary commands into the underlying shell execution. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H from NVD primary) indicates local exploitation with low complexity, though the practical impact extends to remote scenarios when the vulnerable functions process data from network-facing application endpoints. The fix in version 5.3.1 addresses this by enforcing type checking to reject array inputs and properly sanitizing string parameters before shell command construction.
Frequently Asked Questions
Is CVE-2021-21315 being actively exploited?
Yes. CVE-2021-21315 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.76% (99.85th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-21315?
CVE-2021-21315 affects the systeminformation npm package for Node.js in versions prior to 5.3.1. Additionally, Apache Cordova version 10.0.0 is affected through its dependency on the vulnerable package. Any Node.js application that uses the systeminformation library should be checked.
How do I fix CVE-2021-21315?
Upgrade the systeminformation npm package to version 5.3.1 or later. As a workaround, validate that all parameters passed to si.inetLatency(), si.inetChecksite(), si.services(), and si.processLoad() are strings, not arrays, and apply proper string sanitization.
How severe is CVE-2021-21315?
CVE-2021-21315 has a CVSS 3.1 score of 7.8 (HIGH) from NVD and 7.1 (HIGH) from the vendor. The vulnerability enables OS command injection which can lead to full system compromise. The EPSS score of 93.76% (99.85th percentile) places it among the most actively exploited vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.