PT-2018-1369 · Node.Js · Pdf-Image

Defmax · Published 2018-05-30 · Updated 2020-09-01 · CVE-2018-3757

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pdf-image versions prior to 2.0.0

Description The issue is related to the lack of neutralization of special elements in input data for the GetInfoCommand function in the pdf-image tool for Node.js. This can be exploited by a remote attacker to execute arbitrary code using a specially crafted request. The vulnerability exists due to an unescaped string parameter, and it is exploitable if the attacker has control over the pdfFilePath variable passed into pdf-image.

Recommendations Update to version 2.0.0 or later. As a temporary workaround, consider restricting access to the pdf-image tool to minimize the risk of exploitation, especially for the pdfFilePath variable. Avoid using unvalidated input for the pdfFilePath variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2018-00912

CVE-2018-3757

GHSA-5GWH-G79J-VH4Q

Affected Products

Pdf-Image

References · 8

• 🔥 https://hackerone.com/reports/340208 · Exploit
• https://github.com/roest01/node-pdf-image/commit/54679496a89738443917608c2bbe2f6e5dd20e83 · Patch
• https://osv.dev/vulnerability/CVE-2018-3757 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00912 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3757 · Security Note
• https://osv.dev/vulnerability/GHSA-5gwh-g79j-vh4q · Vendor Advisory
• https://github.com/roest01/node-pdf-image · Note
• https://npmjs.com/advisories/670 · Note