CVE-2020-7752: 
JavaScript vulnerability analysis and mitigation

CVE-2020-7752 affects the systeminformation package before version 4.27.11. The vulnerability was discovered and disclosed on October 26, 2020. The vulnerability exists in the inetChecksite() function where an attacker can perform command injection by concatenating curl's parameters to overwrite Javascript files and execute arbitrary OS commands (NVD).

The vulnerability exists in the internet.js file's inetChecksite() function where insufficient sanitization of user input allows command injection. The function was vulnerable to parameter concatenation attacks that could be used to overwrite Javascript files and execute operating system commands. The issue was fixed by implementing additional input sanitization including removing spaces, dollar signs, parentheses, and curly braces from the URL parameter (GitHub Commit).

An attacker can exploit this vulnerability to execute arbitrary operating system commands by manipulating the URL parameter passed to the inetChecksite() function. This could lead to complete system compromise if the application runs with elevated privileges (NVD).

The vulnerability can be exploited by passing specially crafted URLs to the inetChecksite() function that contain shell command injection payloads. The attack requires the ability to pass input to this function (NVD).

The vulnerability was patched in systeminformation version 4.27.11. Users should upgrade to this version or later to receive the security fix. The fix implements additional input sanitization to prevent command injection attacks (GitHub Commit).