Quick answers
- Is CVE-2020-8132 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-8132 being exploited in the wild.
- How severe is CVE-2020-8132?
- Low severity, with a CVSS score of 3.1, published 10 May 2021.
- Which products and versions are affected?
- pdf-image (npm) SEMVER:introduced=0,last_affected=2.0.0.
- Is there a fix for CVE-2020-8132?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2020-8132 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-8132?
- Check whether you run pdf-image (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The pdf-image npm package (versions ≤ 2.0.0) lacks proper input validation on PDF file paths, enabling code injection attacks (CWE-20: Improper Input Validation, CWE-94: Improper Control of Generation of Code). An attacker can craft a malicious PDF file path using untrusted user input to achieve arbitrary code execution on the target system. The vulnerability requires the application to construct file paths based on user-controlled data without sanitization. No authentication or complex interaction is needed; the attack is network-accessible if the application exposes PDF conversion functionality. Patches are available in versions after 2.0.0.
Affected products
- pdf-image pdf-image ≤ 2.0.0
Identifiers
- CVE-2020-8132
- GHSA-rv7p-mmwq-x674
Timeline
- 2020-02-28: disclosed
- 2021-05-10: advisory