Executive brief
ntesseract is a Node.js library that provides an interface to the Tesseract OCR (optical character recognition) engine for extracting text from images. A command injection vulnerability allows attackers to execute arbitrary system commands by crafting malicious image file paths or parameters, potentially leading to full system compromise.
Technical details
ntesseract versions before 0.2.9 are vulnerable to command injection (CWE-77) via lib/tesseract.js. The vulnerability exists because user-supplied input (image file paths and options) is not properly sanitized before being passed to shell command execution. An attacker can inject shell metacharacters in the image parameter to break out of the intended command and execute arbitrary commands. The vulnerable component constructs OS commands without proper escaping. No authentication or user interaction is required; the vulnerability is triggered when the library processes an attacker-controlled image path. The fix, released in version 0.2.9, adds input validation to detect and reject strings beginning with double quotes.
Affected products
- npm ntesseract before 0.2.9
Timeline
- 2022-07-26: disclosed: Published in GitHub Advisory Database
- 2022-07-25: patched: Fix released in version 0.2.9