Executive brief
pdf-image is a Node.js library that converts PDF pages to image files using ImageMagick. Versions prior to 2.0.0 allow attackers to execute arbitrary system commands if they can control the PDF file path passed to the library. This could lead to full system compromise, data theft, or service disruption depending on the privileges of the application using the library.
Technical details
The vulnerability is a command injection flaw (CWE-78) in pdf-image versions before 2.0.0, where unsanitized user input in the pdfFilePath parameter is passed to shell commands via the child_process.exec() function. The root cause is the use of exec() instead of safer alternatives like spawn() with argument arrays. The vulnerability is exploitable if an attacker has direct or indirect control over the pdfFilePath variable, requiring no authentication. An attacker can inject shell metacharacters to break out of the intended command and execute arbitrary shell commands with the privileges of the Node.js process. The fix was implemented in version 2.0.0 by replacing exec() with spawn() and the child-process-promise library, which properly separates command and arguments.
Affected products
- pdf-image pdf-image before 2.0.0
Timeline
- 2020-09-01: disclosed: Vulnerability published in GitHub Advisory Database
- 2018-05-14: patched: Fix committed to resolve command injection; version 2.0.0 released with mitigation