Executive brief
muhammara and hummus are JavaScript libraries used to create and manipulate PDF documents. Both libraries crash with a denial of service when the PDFStreamForResponse function is passed invalid or null input, causing the application to terminate unexpectedly and disrupting service availability.
Technical details
The vulnerability is a null pointer dereference (CWE-690) in the PDFStreamForResponse() function that fails to validate input parameters. When invalid data (including null values) is passed to PDFStreamForResponse, the library attempts to dereference a null pointer while writing PDF headers, causing an application crash. No authentication or special privileges are required; the vulnerability can be triggered by any code path that calls PDFStreamForResponse with malformed input. An attacker can cause a denial of service by crafting a request that leads to the vulnerable function being called with bad data. Patches are available in muhammara version 2.6.0 and hummus version 1.0.111.
Affected products
- Galkahana HummusJS before 1.0.111
- Julian Hille MuhammaraJS before 2.6.0
Timeline
- 2022-11-01: disclosed: Published in GitHub Advisory Database
- 2022-11-01: patched: Hummus 1.0.111 and muhammara 2.6.0 released with fixes