fix(deps): update dependency systeminformation to v5.23.8 [security] #11787
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.23.5
->5.23.8
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2024-56334
Summary
The SSID is not sanitized when before it is passed as a parameter to cmd.exe in the
getWindowsIEEE8021x
function. This means that malicious content in the SSID can be executed as OS commands.Details
I have exploited this vulnerability in a Windows service using version 5.22.11 of the module, to escalate privileges (in an environment where I am authorized to do so). However, as far as I can see from the code, it is still present in master branch at time of writing, on line 403/404 of network.js.
The SSID is obtained from
netsh wlan show interface ...
ingetWindowsWirelessIfaceSSID
, and then passed tocmd.exe /d /s /c "netsh wlan show profiles ...
ingetWindowsIEEE8021x
, without sanitization.PoC
First, the command injection payload should be included in the connected Wi-Fi SSID. For example create hotspot on mobile phone or other laptop, set SSID to payload, connect to it with victim Windows system. Two example SSID's to demonstrate exploitation are below.
Demonstration to run ping command indefinitely:
Run executable with privileges of the user in which vulnerable function is executed. Chosen executable should should be placed in (assuming system drive is C):
C:\a\a.exe
.Then, the vulnerable function can be executed on the victim system, for example, using:
Now the chosen command,
PING.exe
ora.exe
will be run through the cmd.exe command line.Impact
This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation.
Release Notes
sebhildebrandt/systeminformation (systeminformation)
v5.23.8
Compare Source
v5.23.6
Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.