systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
Summary
On Linux, systeminformation's networkInterfaces() is vulnerable to OS command injection through the Debian/Ubuntu interfaces(5) source directive. While collecting per-interface DHCP state, the library reads /etc/network/interfaces and, for every source <path> line it encounters, extracts the path token *from the file content* and interpolates it unquoted into a shell command string that is run via execSync(). A source line whose path contains shell metacharacters executes arbitrary commands with the privileges of the calling Node.js process.
This is the same root-cause class as the previously-fixed NetworkManager-connection-name injection in this file: a value parsed out of local system state is re-interpolated into a shell command string without sanitization. The NetworkManager paths were converted to argument-array execution, but the interfaces(5) source-recursion sink in checkLinuxDCHPInterfaces() was left unfixed and still builds a shell string. The input to this sink is *unsanitized* (unlike the iface/connectionName paths, which pass through util.sanitizeString in strict mode before reaching their commands).
Impact
An attacker who can place or influence a sourced path in /etc/network/interfaces (or any file it transitively sources) achieves command execution inside any process that calls networkInterfaces(). Realistic affected deployments are the same ones that motivate this library:
- local inventory / asset agents
- monitoring and diagnostics agents
- admin-dashboard backends collecting host information
- device-management / desktop agents
If such a process runs with elevated privileges, the injected command runs with those privileges. networkInterfaces() is a core, frequently-called API and is reached transitively by getStaticData() / getAllData(), so the sink is exercised by ordinary usage on Linux.
Threat model
The dangerous value is not a function argument supplied by the caller. It is read from the *content* of an interfaces(5) configuration file. The stock Debian/Ubuntu layout uses source /etc/network/interfaces.d/* and source-directory fan-out, so the parser routinely follows source directives into other files and re-parses their source lines. Any actor who can write a file that becomes reachable through that source chain — for example a lower-privileged process or configuration-management hook that drops a file into a sourced directory, or a tool that materializes an interfaces snippet from semi-trusted input — controls the path token that lands in the shell command. No NetworkManager activation or special hardware is required; the only precondition is that one sourced path string contains shell metacharacters.
Vulnerable code
lib/network.js, checkLinuxDCHPInterfaces() (current 5.31.6 line numbers):
```js
// lib/network.js
function checkLinuxDCHPInterfaces(file) {
let result = [];
try {
const cmd = cat ${file} 2> /dev/null | grep 'iface\\|source'; // <-- unquoted ${file} -> shell sink
const lines = execSync(cmd, util.execOptsLinux).toString().split('\n');
lines.forEach((line) => {
const parts = line.replace(/\s+/g, ' ').trim().split(' ');
if (parts.length >= 4) {
if (line.toLowerCase().indexOf(' inet ') >= 0 && line.toLowerCase().indexOf('dhcp') >= 0) {
result.push(parts[1]);
}
}
if (line.toLowerCase().includes('source')) {
const file = line.split(' ')[1]; // <-- path parsed FROM file content
result = result.concat(checkLinuxDCHPInterfaces(file)); // <-- recurses, re-feeding attacker path
}
});
} catch {
util.noop();
}
return result;
}
```
util.execOptsLinux sets no shell option, so execSync(cmd, util.execOptsLinux) runs cmd through /bin/sh. The ${file} token is interpolated raw — not quoted, not passed through util.sanitizeString/sanitizeShellString — so ;, $( ), backticks, |, &, redirections, and even a bare space all break out of the intended cat/grep pipeline.
Reach chain to the public API:
```js
// lib/network.js, getLinuxDHCPNics()
result = checkLinuxDCHPInterfaces('/etc/network/interfaces');
```
```js
// lib/network.js, networkInterfaces() (Linux branch)
_dhcpNics = getLinuxDHCPNics();
```
networkInterfaces() is also reached by getStaticData() and getAllData() in lib/index.js.
Reproduction
The PoC exercises the verbatim shipped sink function extracted from the installed node_modules/systeminformation/lib/network.js (version pinned to 5.31.6), bound to the same child_process.execSync and shipped util.execOptsLinux the library uses. It then drives the exact source-recursion data flow with a malicious sourced path. A negative control with a benign path confirms no executio
