CVE-2018-3746: Command Injection in pdfinfojs
Summary
CVE-2018-3746: Command Injection in pdfinfojs. Affects pdfinfojs versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pdfinfojs is an npm package that provides functionality to extract information from PDF files. It is commonly used in applications that require parsing and analyzing PDF documents. However, versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This vulnerability arises when an attacker can control the filename parameter passed into the pdfinfojs constructor. By exploiting this vulnerability, an attacker can execute arbitrary commands on the system hosting the vulnerable application.
Vulnerability Detail
The command injection vulnerability in pdfinfojs allows an attacker to manipulate the filename parameter and inject arbitrary commands. This can lead to various malicious activities, such as executing arbitrary code, accessing sensitive information, or disrupting the normal operation of the application. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
0.4.1
This is the first release that contains the fix.
npm install pdfinfojs@0.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating pdfinfojs is not immediately feasible, a temporary workaround is to sanitize the filename parameter before passing it to the pdfinfojs constructor. This can be done by implementing input validation and filtering techniques to prevent any malicious characters or commands from being executed.
Conclusion
In conclusion, pdfinfojs versions before 0.4.1 are vulnerable to command injection. It is crucial to update to the latest version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pdfinfojs →
FAQ
pdfinfojs is an npm package that provides functionality to extract information from PDF files.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a system by manipulating user-controlled input.
An attacker can exploit this vulnerability by controlling the filename parameter passed into the pdfinfojs constructor and injecting malicious commands.
The potential consequences of this vulnerability include executing arbitrary code, accessing sensitive information, and disrupting the normal operation of the application.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
