CVE-2021-21315
CISA 기관 조치 기한: 2022-02-01
Npm package System Information Library for Node.JS
Qualys 위협 인텔 · 심각도 4/5 · QID 150503 · Web Application
공개 익스플로잇
쉬운 악용
CISA KEV
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
KEV 필수 조치: Apply updates per vendor instructions.
타임라인
- NVD 공개
- CISA KEV 등재(실제 악용 확인) 공개 후 336일
- CISA 기관 조치 기한 경과
날짜 정보 없는 신호: 공개 PoC 5건
벡터: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
공개 익스플로잇 / PoC
- GitHub 공개 PoC 5건 — 대표 레포 ↗