CVE-2024-56334

Executive Summary

CVE-2024-56334 is a critical OS Command Injection vulnerability in the systeminformation npm library, a widely used package for retrieving system and OS information in Node.js. The flaw exists in the getWindowsIEEE8021x function, where SSID (Service Set Identifier) values are not sanitized before being passed as a parameter to cmd.exe. This allows an attacker who can control or influence the SSID of a Wi-Fi network to inject arbitrary OS commands. Successful exploitation can lead to remote code execution (RCE) or local privilege escalation (LPE), depending on the context in which the library is used. The vulnerability has been patched in version 5.23.7, and all users are strongly advised to upgrade immediately.

Supply Chain & Package Security

This vulnerability is particularly dangerous due to its presence in the npm ecosystem. The systeminformation package is a direct dependency for thousands of projects and an indirect dependency for many more. An attacker could exploit this flaw by crafting a malicious Wi-Fi SSID that, when scanned by a system running a vulnerable version of the library, triggers command execution. This represents a significant supply chain risk, as the attack vector is passive (the victim only needs to be within range of a malicious access point) and requires no user interaction beyond the normal operation of the vulnerable application.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to influence the SSID seen by the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs low-level privileges (e.g., ability to set up a rogue access point).
• User Interaction (UI): None (N) – No user action is required beyond the application scanning Wi-Fi networks.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Full system compromise possible.

Threat Level: High. The low attack complexity and potential for remote code execution make this a critical threat for any system using the vulnerable library.

Deep Dive & Mechanics

The vulnerability resides in the getWindowsIEEE8021x function within the systeminformation library. This function is designed to retrieve IEEE 802.1X authentication information for Wi-Fi networks on Windows systems. To do this, it constructs a command string that is executed via cmd.exe.

The core issue is that the SSID (the name of the Wi-Fi network) is directly concatenated into the command string without any sanitization or escaping. An attacker can set up a rogue Wi-Fi access point with a malicious SSID containing shell metacharacters (e.g., &, |, ;, $(), backticks). When the vulnerable application calls getWindowsIEEE8021x, the library will execute a command similar to:

cmd.exe /c netsh wlan show profiles name="MALICIOUS_SSID" key=clear

If the SSID contains something like & calc.exe &, the command becomes:

cmd.exe /c netsh wlan show profiles name="& calc.exe &" key=clear

This results in the execution of calc.exe (or any arbitrary command) before the intended netsh command.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.23.7):

// In getWindowsIEEE8021x function
let command = `cmd.exe /c netsh wlan show profiles name="${ssid}" key=clear`;
exec(command, function(error, stdout, stderr) {
    // ...
});

Patched Code (5.23.7):

// In getWindowsIEEE8021x function
const sanitizedSSID = ssid.replace(/[^a-zA-Z0-9\s\-_]/g, '');
let command = `cmd.exe /c netsh wlan show profiles name="${sanitizedSSID}" key=clear`;
exec(command, function(error, stdout, stderr) {
    // ...
});

The patch introduces a sanitization step that removes all characters from the SSID except alphanumeric characters, spaces, hyphens, and underscores. This effectively neutralizes any shell metacharacters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A system running a vulnerable version of systeminformation (before 5.23.7).
• A Wi-Fi adapter capable of creating a rogue access point (e.g., using airbase-ng or similar tools).
• The target application must be actively scanning for Wi-Fi networks and calling getWindowsIEEE8021x.

Exploitation Steps:

1. Set up a rogue access point with a malicious SSID. For example, using airbase-ng:

   sudo airbase-ng -e "& calc.exe &" wlan0
   

   This creates a Wi-Fi network with the SSID & calc.exe &.

2. Wait for the target system to scan for Wi-Fi networks. The vulnerable application will call getWindowsIEEE8021x, which will execute the injected command.

3. Achieve code execution. In this example, calc.exe will be launched. For a real attack, a reverse shell or other payload would be used:

   # SSID: & powershell -e <base64_encoded_reverse_shell> &
   

Note: No public exploit code is available at this time.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual command-line arguments passed to cmd.exe or netsh.exe.
• Look for SSIDs containing shell metacharacters in network logs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade systeminformation to version 5.23.7 or later.
• If upgrading is not possible, implement a WAF or endpoint detection rule to block SSIDs containing special characters.
• Restrict the execution of cmd.exe for the Node.js process using AppLocker or similar tools.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SSIDs containing shell metacharacters: &, |, ;, $(), `, %0a, %0d.
  • Rogue access points broadcasting suspicious SSIDs.

• Host IOCs:

  • Unusual child processes spawned by node.exe (e.g., cmd.exe, powershell.exe, calc.exe).
  • Command-line arguments to cmd.exe containing SSID values with special characters.
  • Event ID 4688 (Windows) showing cmd.exe launched with suspicious parameters.

• File IOCs:

  • Presence of systeminformation package version < 5.23.7 in node_modules.

Detection Engineering

YARA Rule

rule CVE_2024_56334_SSID_Injection {
    meta:
        description = "Detects SSID injection attempts targeting systeminformation library"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-56334"
    strings:
        $cmd1 = /netsh wlan show profiles name="[^"]*[&|;`$()][^"]*"/ nocase
        $cmd2 = /cmd\.exe.*netsh.*wlan.*show.*profiles.*name="[^"]*[&|;`$()]/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-56334 - SSID Command Injection via systeminformation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts via malicious SSID in systeminformation library
author: Valters IT
date: 2024-12-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56334
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'netsh'
            - 'wlan'
            - 'show'
            - 'profiles'
            - 'name='
        CommandLine|contains:
            - '&'
            - '|'
            - ';'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate SSIDs containing special characters (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-56334 - SSID Command Injection Attempt"; flow:to_server; content:"netsh wlan show profiles name=\""; nocase; pcre:"/name=\"[^\"]*[&|;`$()][^\"]*\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the systeminformation package to version 5.23.7 or later:

   npm install systeminformation@5.23.7
   

2. Verify the upgrade by checking the package version in package.json or node_modules/systeminformation/package.json.

Long-term Mitigations:

• Implement input validation for all external data, especially when used in command execution.
• Use parameterized commands or safer APIs (e.g., child_process.execFile instead of child_process.exec).
• Regularly audit dependencies for known vulnerabilities using tools like npm audit or Snyk.
• Apply the principle of least privilege to the Node.js process.

Workarounds:

• If upgrading is not possible, disable the getWindowsIEEE8021x function by monkey-patching it:

  const si = require('systeminformation');
  si.getWindowsIEEE8021x = () => Promise.resolve([]);
  

• Use a firewall to block outbound connections from the Node.js process to mitigate potential RCE impact.

Valters IT
Securing Digital Frontiers