CVE-2021-43113: Command injection in itext7-core
Summary
CVE-2021-43113: Command injection in itext7-core. Affects com.itextpdf:itext7-core versions < 7.1.17. Fixed in 7.1.17. How to fix ↓
Also tracked for
- libitext5-java · Debian:11
The same CVE-2021-43113 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The itext7-core package is a component of iTextPDF, a popular Java library for creating and manipulating PDF documents. It provides various functionalities for generating, modifying, and analyzing PDF files. However, a vulnerability has been discovered in itext7-core versions prior to 7.1.17 that allows command injection. This vulnerability arises from mishandling the filename parameter used in the Ghostscript command line within GhostscriptHelper.java.
Vulnerability Detail
The command injection vulnerability in itext7-core can be exploited by an attacker to execute arbitrary commands on the system where the vulnerable code is running. By manipulating the filename parameter, an attacker can inject malicious commands that will be executed when the Ghostscript command is invoked. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Minimum fixed version
7.1.17
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to a fixed version is not immediately feasible, it is recommended to sanitize and validate any user-supplied input before using it as the filename parameter in the Ghostscript command. This can help prevent command injection by ensuring that only valid and safe filenames are passed to the command line.
Conclusion
The command injection vulnerability in itext7-core poses a significant risk to systems using vulnerable versions of the package. It is crucial to promptly upgrade to a fixed version, such as 7.1.17 or later, to mitigate the risk of command injection. Sanitizing and validating user input can serve as a temporary workaround until the upgrade is performed. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for com.itextpdf:itext7-core →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the affected system, potentially leading to unauthorized access, data leakage, or complete compromise of the system.
Versions of itext7-core prior to 7.1.17 are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
You can find more information about this vulnerability, including its technical details and the fixed versions, in the advisory published by the GitHub Advisory Database. The link to the advisory is provided in the 'database_specific' field of this report.
Related vulnerabilities
Recent vulnerabilities recorded for com.itextpdf:itext7-core.
