From af9b8a522e31271ab7f82ef75e92cba12f52da90 Mon Sep 17 00:00:00 2001 From: Sebastian Hildebrandt Date: Sun, 14 Mar 2021 18:08:45 +0100 Subject: [PATCH] sanitizeShellString() improvement --- CHANGELOG.md | 1 + docs/history.html | 5 +++++ docs/index.html | 6 +++--- docs/security.html | 17 +++++++++++++++++ lib/util.js | 9 +++++---- 5 files changed, 31 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ad1b1c..40e1f1c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -77,6 +77,7 @@ For major (breaking) changes - **version 4, 3 and 2** - see end of page. | Version | Date | Comment | | -------------- | -------------- | -------- | +| 5.6.3 | 2021-03-10 | `sanitizeShellString()` improvement | | 5.6.2 | 2021-03-10 | `networkInterfaces()` `cpu()` improvement (win) | | 5.6.1 | 2021-03-03 | `get()` fixed issue boolean parameters | | 5.6.0 | 2021-03-03 | `cpuTemperature()` added socket and chipset temp (linux) | diff --git a/docs/history.html b/docs/history.html index ddeb8cd..f91d534 100644 --- a/docs/history.html +++ b/docs/history.html @@ -56,6 +56,11 @@ + + 5.6.3 + 2021-03-14 + sanitizeShellString() improvements + 5.6.2 2021-03-10 diff --git a/docs/index.html b/docs/index.html index 0965949..dfaecaf 100644 --- a/docs/index.html +++ b/docs/index.html @@ -166,11 +166,11 @@
- Security advisory:
Update to v5.3.2 + Security advisory:
Update to v5.6.3
systeminformation
 
-
New Version: 5.6.2
+
New Version: 5.6.3
@@ -209,7 +209,7 @@
Downloads last month
-
395
+
397
Dependents
diff --git a/docs/security.html b/docs/security.html index 16637dc..7508f12 100644 --- a/docs/security.html +++ b/docs/security.html @@ -43,6 +43,23 @@
Security Advisories
+

Command Injection Vulnerability

+

Affected versions: + < 5.6.3 and < 4.34.13
+ Date: 2021-03-14
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a manipulated string prototype as a parameter to the following functions. Affected commands: inetLatency(), inetChecksite(), services(), processLoad().

+ +

Patch

+

Problem was fixed with additional parameter checking. Please upgrade to version >= 5.6.3 (or >= 4.34.13 if you are using version 4).

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to inetLatency(), inetChecksite(), services(), processLoad() (string only)

+
+

Insufficient File Scheme Validation

Affected versions: < 5.3.2 and < 4.34.12
diff --git a/lib/util.js b/lib/util.js index 24b3e6e..04e5a89 100644 --- a/lib/util.js +++ b/lib/util.js @@ -529,10 +529,11 @@ function sanitizeShellString(str, strict = false) { s[i] === '\'' || s[i] === '`' || s[i] === '"' || - strict && s[i] === '@' || - strict && s[i] === ' ' || - strict && s[i] == '{' || - strict && s[i] == ')')) { + s[i].length > 1 || + (strict && s[i] === '@') || + (strict && s[i] === ' ') || + (strict && s[i] == '{') || + (strict && s[i] == ')'))) { result = result + s[i]; } }