Attack Chain

1. Attacker creates or modifies a NetworkManager connection profile with a malicious name containing shell metacharacters (e.g., name$(...), name"; ...; #).
2. The crafted NetworkManager profile is activated via nmcli connection up <malicious_profile_name>.
3. A Node.js application uses the systeminformation library and calls the networkInterfaces() function.
4. networkInterfaces() executes nmcli device status to retrieve network interface information, including the connection name.
5. The library parses the connectionName from the output of nmcli device status without proper sanitization.
6. The unsanitized connectionName is interpolated into shell commands executed via execSync() in getLinuxIfaceDHCPstatus(), getLinuxIfaceDNSsuffix(), and getLinuxIfaceIEEE8021xAuth().
7. The injected shell commands are executed with the privileges of the Node.js process.
8. The attacker achieves arbitrary command execution on the system.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system with the privileges of the Node.js process using the systeminformation library. This could lead to local privilege escalation if the Node.js process is running with elevated privileges. Affected deployments include local inventory agents, monitoring agents, diagnostics tools, admin dashboard backends collecting host information, and privileged local desktop or device-management agents. If such a process runs with elevated privileges, the injected command executes with those same elevated privileges.

Recommendation

• Implement input sanitization or, preferably, avoid shell interpolation entirely by using execFileSync() or spawnSync() with argument arrays as recommended in the advisory. This mitigates the command injection vulnerability in lib/network.js (specifically lines 620, 660, and 676).
• Monitor for suspicious NetworkManager connection profile modifications, specifically looking for profile names containing shell metacharacters as part of a broader strategy to detect command injection attempts.
• Deploy the provided Sigma rules to detect exploitation attempts by monitoring for nmcli commands with connection names containing shell metacharacters in process execution logs.
• Audit Node.js applications using systeminformation on Linux systems and prioritize patching or implementing the suggested mitigations.