Executive brief
Muhammara and Hummus are JavaScript libraries used to programmatically manipulate PDF documents. A maliciously crafted PDF file can trigger a crash when an application attempts to append it to another PDF, causing a denial of service. Affected applications using these libraries may become unavailable if processing untrusted PDF inputs.
Technical details
The vulnerability is an unchecked return value leading to null pointer dereference in PDFDocumentHandler.cpp. The root cause occurs when the library fails to validate that a function call returns a valid pointer before dereferencing it during PDF append operations. An attacker can exploit this by supplying a maliciously crafted PDF file that causes the vulnerable function to return NULL. The attack requires no authentication or user interaction and is reachable over the network. Successful exploitation results in a denial of service (application crash). Muhammara patched this issue in version 2.6.0; Hummus has not released a patch.
Affected products
- Julian Hille Muhammara before 2.6.0
- Gal Kahana Hummus all versions
Timeline
- 2022-11-02: disclosed: Advisory published on GitHub and OSV
- 2022-11-02: patched: Muhammara patched in version 2.6.0