Command Injection Vulnerability in iTextPDF (libitext5-java) - CVE-2021-43113
Summary
CVE-2021-43113: iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java. Affects libitext5-java across 4 version ranges.
< 5.5.13.2-1+deb11u1
< 0231a60e92a1968601d1d7779dc3f57f1274f32f
< a2746010d27536b68d60d53f81912d5a7c537b7e
>= ed042f3ff209ceb0a5571415937bb5aaba8bd5ff, < a2746010d27536b68d60d53f81912d5a7c537b7e
Fixed in 5.5.13.2-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
iTextPDF is a widely used library for creating and manipulating PDF documents in Java. It provides a rich set of features for document generation, including text, images, and graphics. The library is integral for applications that require dynamic PDF content generation. However, certain versions of iTextPDF, specifically those prior to 7.1.17, are vulnerable to a command injection flaw that can be exploited through the CompareTool filename.
Vulnerability Detail
The vulnerability, identified as CVE-2021-43113, allows an attacker to inject arbitrary commands via a specially crafted filename in the CompareTool. This filename is mishandled when passed to the Ghostscript command line in the GhostscriptHelper.java file. If exploited, this could lead to unauthorized command execution on the server, potentially compromising the integrity and confidentiality of the system. The vulnerability affects versions of iText 7 up to (but not including) 7.1.17.
How To Fix
Minimum fixed version
5.5.13.2-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libitext5-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling the CompareTool functionality or restricting the input to the CompareTool to prevent the injection of malicious filenames. Ensure that any user input is properly sanitized before being processed.
Conclusion
CVE-2021-43113 is a critical command injection vulnerability in the iTextPDF library that can lead to severe security risks if not addressed. Users are strongly advised to update their libraries to the latest versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for libitext5-java →
FAQ
CVE-2021-43113 is a command injection vulnerability in iTextPDF that allows attackers to execute arbitrary commands via a manipulated filename in the CompareTool.
The vulnerability affects iText 7 versions up to (but not including) 7.1.17.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-43113 is 9.8, indicating a critical level of severity.
If you cannot upgrade, consider disabling the CompareTool functionality or sanitizing user inputs to prevent command injection.
Related vulnerabilities
Recent vulnerabilities recorded for libitext5-java.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
