Executive brief
A vulnerability in the ZMarkdown 'rebber' library, which converts Markdown text into LaTeX documents, allows attackers to execute unauthorized commands on the server. By submitting specially crafted Markdown content, an attacker can break out of the intended document structure and run malicious code. This could lead to a full system takeover, data theft, or disruption of services.
Technical details
An OS command injection vulnerability exists in the 'rebber' module of ZMarkdown, specifically within the handling of CodeBlocks during Markdown-to-LaTeX conversion. The root cause is improper neutralization of LaTeX escape sequences; an attacker can provide input that closes a CodeBlock and uses LaTeX commands like '\immediate\write18' to execute arbitrary shell commands on the host system. This is reachable via any interface that processes untrusted Markdown through the rebber compiler without additional sanitization. The vulnerability is patched in version 5.2.1, and a workaround involves implementing a custom macro to escape closing LaTeX sequences.
Affected products
- ZMarkdown (Zeste de Savoir) rebber < 5.2.1
Timeline
- 2021-08-31: advisory: Original GitHub Security Advisory published
- 2021-09-07: disclosed: Public disclosure via OSV database
- 2021-09-07: patched: Version 5.2.1 released to address the issue