Executive brief
office-converter is a Node.js library used to convert documents between different formats. A vulnerability in input validation allows attackers to execute arbitrary commands on servers running this package, potentially compromising the entire system. Since no patch is available, organizations using this library are at ongoing risk of complete server takeover.
Technical details
The vulnerability is a command injection flaw (CWE-20: Improper Input Validation) affecting all versions of office-converter. Due to insufficient input validation, an attacker can supply malicious input that is interpreted as system commands, leading to remote code execution with the privileges of the server process. The attack requires the attacker to interact with the application via its normal input channels (network-reachable, no authentication typically required for typical use). As of the advisory date, no patch has been released; the recommendation is to discontinue use of this package and switch to an alternative.
Affected products
- office-converter office-converter all versions
Timeline
- 2020-09-02: disclosed