PT-2018-1369 · Node.Js · Pdf-Image

Defmax · Publicado 2018-05-30 · Atualizado 2020-09-01 · CVE-2018-3757

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pdf-image versions prior to 2.0.0

Description The issue is related to the lack of neutralization of special elements in input data for the GetInfoCommand function in the pdf-image tool for Node.js. This can be exploited by a remote attacker to execute arbitrary code using a specially crafted request. The vulnerability exists due to an unescaped string parameter, and it is exploitable if the attacker has control over the pdfFilePath variable passed into pdf-image.

Recommendations Update to version 2.0.0 or later. As a temporary workaround, consider restricting access to the pdf-image tool to minimize the risk of exploitation, especially for the pdfFilePath variable. Avoid using unvalidated input for the pdfFilePath variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2018-00912

CVE-2018-3757

GHSA-5GWH-G79J-VH4Q

Produtos afetados

Pdf-Image

Referências · 8

• 🔥 https://hackerone.com/reports/340208 · Exploit
• https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83 · Correção
• https://github.com/roest01/node-pdf-image · Nota
• https://osv.dev/vulnerability/CVE-2018-3757 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00912 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-3757 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5gwh-g79j-vh4q · Aviso do Fabricante
• https://npmjs.com/advisories/670 · Nota