PT-2022-7868 · Nodepdf · Nodepdf

Anthony Weems · Published 2022-07-28 · Updated 2022-08-04 · CVE-2016-4991

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nodepdf version 1.3.0

Description The issue arises from the input passed to the Pdf() function being shell escaped and then passed to child process.exec() during PDF rendering. However, the shell escape fails to properly encode special characters, such as semicolon and curly braces, which can be exploited to achieve command execution.

Recommendations For nodepdf version 1.3.0, consider disabling the Pdf() function until a patch is available to prevent command execution exploitation. Restrict access to the child process.exec() function to minimize the risk of exploitation. Avoid using special characters, such as semicolon and curly braces, in the input passed to the Pdf() function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2016-4991

Affected Products

Nodepdf

References · 4

• 🔥 https://lf.lc/cve/cve-2016-4991 · Exploit
• https://osv.dev/vulnerability/CVE-2016-4991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4991 · Security Note
• https://t.me/cibsecurity/47215 · Telegram Post