diff --git a/2 b/2 new file mode 100644 index 0000000..5d8b2f0 --- /dev/null +++ b/2 @@ -0,0 +1,2 @@ +WARNING: The airport command line tool is deprecated and will be removed in a future release. +For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool. diff --git a/CHANGELOG.md b/CHANGELOG.md index 036ab6c..3f05990 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -90,6 +90,7 @@ For major (breaking) changes - **version 4, 3 and 2** - see end of page. | Version | Date | Comment | | ------- | ---------- | --------------------------------------------------------------------------------------------------- | +| 5.23.15 | 2024-12-21 | `users()` fixed parsing (macOS Seguoia) | | 5.23.14 | 2024-12-18 | `chassis()` new chassis detection (macOS) | | 5.23.13 | 2024-12-14 | `wifiConnections()` improved BSSID parsing (windows) | | 5.23.12 | 2024-12-13 | `networkConnections()` fixed wrong PID parsing (macOS) | diff --git a/README.md b/README.md index 0c4a986..0d6c964 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ I wish you all a Merry Christmas and a peaceful New Year 2025. -This is amazing. Started as a small project just for myself, it now has > 15,000 +This is amazing. Started as a small project just for myself, it now has > 17,000 lines of code, > 650 versions published, up to 8 mio downloads per month, > 330 mio downloads overall. #1 NPM ranking for backend packages. Thank you to all who contributed to this project! diff --git a/docs/history.html b/docs/history.html index b7ae40e..0c2ff41 100644 --- a/docs/history.html +++ b/docs/history.html @@ -57,6 +57,11 @@ + + 5.23.15 + 2024-12-21 + users(), wifiNetworks() fixed parsing (macOS Seguoia) + 5.23.14 2024-12-18 diff --git a/docs/index.html b/docs/index.html index f56234d..4520f7f 100644 --- a/docs/index.html +++ b/docs/index.html @@ -166,11 +166,11 @@
- Security advisory:
Update to v5.21.8 + Security advisory:
Update to v5.23.7
systeminformation
 
-
New Version: 5.23.13
+
New Version: 5.23.15
@@ -204,7 +204,7 @@
-
17,089
+
17,135
Lines of code
diff --git a/docs/security.html b/docs/security.html index 4f4404f..9245321 100644 --- a/docs/security.html +++ b/docs/security.html @@ -44,10 +44,27 @@
Security Advisories
+

SSID Command Injection Vulnerability

+

Affected versions: + < 5.23.7
+ Date: 2024-11-11
+ CVE indentifier CVE-2024-56334 +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by crafting detected SSIDs in networkInterfaces() on windows machines.

+ +

Patch

+

Problem was fixed with parameter checking. If you are using version 5, please upgrade to version >= 5.23.7.

+
+
+

Passing User Paramters to Systeminformation

For most of the applications that are using systeminformation, there is no reason to worry. But be aware! If you are using inetLatency(), inetChecksite(), services(), processLoad(), versions() with arbitrary untrusted user input, you should pay extra attention! We are doing a lot of input sanitation for those functions inside this package but we cannot handle all cases!

This can lead to serious impact on your servers!

We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing "systeminformation": "^4" in your package.json (dependencies) and run npm install

+
+

SSID Command Injection Vulnerability

Affected versions: diff --git a/lib/users.js b/lib/users.js index 8d877a2..e6ffc3b 100644 --- a/lib/users.js +++ b/lib/users.js @@ -120,7 +120,7 @@ function parseUsersDarwin(lines) { result_w.command = l.slice(5, 1000).join(' '); // find corresponding 'who' line who_line = result_who.filter(function (obj) { - return (obj.user === result_w.user && (obj.tty.substring(3, 1000) === result_w.tty || obj.tty === result_w.tty)); + return (obj.user.substring(0, 10) === result_w.user.substring(0, 10) && (obj.tty.substring(3, 1000) === result_w.tty || obj.tty === result_w.tty)); }); if (who_line.length === 1) { result.push({ diff --git a/lib/wifi.js b/lib/wifi.js index c287b14..72624c0 100644 --- a/lib/wifi.js +++ b/lib/wifi.js @@ -396,6 +396,47 @@ function parseWifiDarwin(wifiObj) { } return result; } + +function parseWifi2Darwin(wifiStr) { + const result = []; + try { + let wifiObj = JSON.parse(wifiStr); + wifiObj = wifiObj.SPAirPortDataType[0].spairport_airport_interfaces[0].spairport_airport_other_local_wireless_networks; + wifiObj.forEach(function (wifiItem) { + + let security = []; + const sm = wifiItem.spairport_security_mode; + if (sm === 'spairport_security_mode_wep') { + security.push('WEP'); + } else if (sm === 'spairport_security_mode_wpa2_personal') { + security.push('WPA2'); + } else if (sm.startsWith('spairport_security_mode_wpa2_enterprise')) { + security.push('WPA2 EAP'); + } else if (sm.startsWith('pairport_security_mode_wpa3_transition')) { + security.push('WPA2/WPA3'); + } else if (sm.startsWith('pairport_security_mode_wpa3')) { + security.push('WPA3'); + } + const channelInfo = new RegExp(/(\d+) \((\d)GHz, (\d+)MHz\)/g).exec(wifiItem.spairport_network_channel); + + result.push({ + ssid: wifiItem._name || '', + bssid: '', + mode: wifiItem.spairport_network_phymode, + channel: parseInt(channelInfo[0].split(' ')[0]), + frequency: wifiFrequencyFromChannel(channelInfo[1]), + signalLevel: null, + quality: null, + security, + wpaFlags: [], + rsnFlags: [] + }); + }); + return result; + } catch (e) { + return result; + } +}; function wifiNetworks(callback) { return new Promise((resolve) => { process.nextTick(() => { @@ -459,10 +500,15 @@ function wifiNetworks(callback) { resolve(result); } } else if (_darwin) { - let cmd = '/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s -x'; + let cmd = '/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s -x >2 /dev/bull; echo "######"; system_profiler -json SPAirPortDataType'; exec(cmd, { maxBuffer: 1024 * 40000 }, function (error, stdout) { const output = stdout.toString(); - result = parseWifiDarwin(util.plistParser(output)); + const parts = output.split('######'); + if (parts[0]) { + result = parseWifiDarwin(util.plistParser(parts[0])); + } else { + result = parseWifi2Darwin(parts[1]); + } if (callback) { callback(result); }