getWindowsIEEE8021x (SSID) 函数中的命令注入漏洞在 systeminformation 中

The vulnerability arises from insufficient sanitization of SSIDs before they are passed as parameters to cmd.exe within the getWindowsIEEE8021x function. An attacker who can control the SSID value, either directly or indirectly through a compromised system, can inject malicious commands. Successful exploitation could lead to remote code execution (RCE) or local privilege escalation, depending on the context in which the systeminformation package is used. This could allow an attacker to gain control of the affected system, steal sensitive data, or install malware.

Applications and systems that utilize the systeminformation Node.js library, particularly those that dynamically retrieve or process SSIDs from network interfaces, are at risk. This includes applications performing network diagnostics, system monitoring, or wireless configuration management. Shared hosting environments where multiple applications share the same Node.js runtime are also at increased risk.

• nodejs: Use npm audit to identify vulnerable dependencies.

npm audit systeminformation

• nodejs: Check for the presence of systeminformation in package.json and verify the version is less than 5.23.7.

grep "systeminformation" package.json

• generic web: Monitor Node.js application logs for unusual command execution attempts related to network interfaces or wireless configurations. Look for patterns resembling shell commands within SSID strings.

1. 2024-12-20Disclosure

   disclosure

1. 已保留2024-12-19
2. 发布日期2024-12-20
3. 修改日期2024-12-24
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-56334 is to upgrade to version 5.23.7 or later of the systeminformation package. There are no known workarounds for this vulnerability beyond upgrading. If upgrading is not immediately feasible due to compatibility issues or breaking changes, carefully review all code that utilizes the getWindowsIEEE8021x function and implement strict input validation to sanitize SSIDs before they are passed to cmd.exe. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a crafted SSID containing malicious commands; the command should not be executed.