search

nrhirani / node-qpdf

A Content Preserving transformations on PDFs wrapped around QPDF
MIT License
51 stars 54 forks source link

Shell Command Injection #8

Open susemeee opened 5 years ago

susemeee commented 5 years ago

Due to the using of /bin/sh -c blablabla... it can execute an arbitrary command with forged 'input'. i.e. 

const qpdf = require('node-qpdf');
qpdf.decrypt('/the/path/of/filename.pdf; ls -al; rm -rf /', 'somepassword');

It could take a time to resolve this issue, but at least it should be documented(to avoid putting arbitrary path on a first argument).

evolutionxbox commented 3 years ago

If the first argument used path.resolve would that help mitigate injection?

const path = require('path');
const qpdf = require('node-qpdf');
const injectString = '/the/path/of/filename.pdf; ls -al; rm -rf /';
qpdf.decrypt(path.resolve(__dirname, injectString), 'somepassword');
sawmurai commented 3 years ago

The problem also exists in the encrypt method. You can for example prove $(echo hello > file) as a password and it will be executed.