Is CVE-2018-3757 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-3757 being exploited in the wild.

How severe is CVE-2018-3757?

Low severity, with a CVSS score of 3.1, published 1 September 2020.

Which products and versions are affected?

pdf-image (npm) SEMVER:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2018-3757?

Yes. pdf-image (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-3757 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-3757?

Check whether you run pdf-image (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-3757: pdf-image command injection vulnerability

CVE-2018-3757 · Severity: low · CVSS 3.1 · Published 2020-09-01

pdf-image is a Node.js library that converts PDF pages to image files using ImageMagick. Versions prior to 2.0.0 allow attackers to execute arbitrary system commands if they can control the PDF file path passed to the library. This could lead to full system compromise, data theft, or service disruption depending on the privileges of the application using the library.

Technologies: pdf-image (npm). Vendors: npm.

Quick answers

Is CVE-2018-3757 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-3757 being exploited in the wild.
How severe is CVE-2018-3757?: Low severity, with a CVSS score of 3.1, published 1 September 2020.
Which products and versions are affected?: pdf-image (npm) SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2018-3757?: Yes. pdf-image (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-3757 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-3757?: Check whether you run pdf-image (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pdf-image (npm): upgrade to 2.0.0 or later
```
npm install pdf-image@2.0.0
```

Technical details

The vulnerability is a command injection flaw (CWE-78) in pdf-image versions before 2.0.0, where unsanitized user input in the pdfFilePath parameter is passed to shell commands via the child_process.exec() function. The root cause is the use of exec() instead of safer alternatives like spawn() with argument arrays. The vulnerability is exploitable if an attacker has direct or indirect control over the pdfFilePath variable, requiring no authentication. An attacker can inject shell metacharacters to break out of the intended command and execute arbitrary shell commands with the privileges of the Node.js process. The fix was implemented in version 2.0.0 by replacing exec() with spawn() and the child-process-promise library, which properly separates command and arguments.

Affected products

pdf-image pdf-image before 2.0.0

Identifiers

CVE-2018-3757
GHSA-5gwh-g79j-vh4q

Timeline

2020-09-01: disclosed: Vulnerability published in GitHub Advisory Database
2018-05-14: patched: Fix committed to resolve command injection; version 2.0.0 released with mitigation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.