Arbitrary File Write Vulnerability in Pandoc: A Critical Security Flaw
Summary
CVE-2023-35936: Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Affects haskell-pandoc across 2 version ranges.
< 3.0.1-2
>= a004216706ef741919f817825843c3d531ff05f3, < 726822fc3247059530579cd6bb3303edf98217dc
Fixed in 3.0.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pandoc is a versatile Haskell library and command-line tool designed for converting between various markup formats. It is widely used for generating documents in formats such as PDF and HTML. The tool's functionality includes the ability to extract media from documents, making it a popular choice among developers and writers. However, a significant security vulnerability has been identified that allows for arbitrary file writes, posing a risk to systems that handle untrusted user input.
Vulnerability Detail
The vulnerability, identified as CVE-2023-35936, exists in Pandoc versions starting from 1.13 and prior to 3.1.4. It can be exploited by providing a specially crafted image element when generating files using the '--extract-media' option or when outputting to PDF format. This flaw enables an attacker to create or overwrite arbitrary files on the system, depending on the privileges of the process running Pandoc. The vulnerability arises from improper handling of percent-encoded paths, which can lead to unauthorized file access and manipulation.
How To Fix
Minimum fixed version
3.0.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haskell-pandocTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can audit the Pandoc command usage and disallow PDF output and the '--extract-media' option to mitigate the risk of exploitation. This can be done by modifying user permissions or creating a wrapper script that restricts these functionalities.
Conclusion
CVE-2023-35936 represents a significant security risk for users of Pandoc, particularly those who handle untrusted input. It is crucial to update to the latest version to mitigate this vulnerability and protect your systems from potential exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for haskell-pandoc →
FAQ
CVE-2023-35936 is a vulnerability in Pandoc that allows for arbitrary file writes due to improper handling of percent-encoded paths.
Pandoc versions starting from 1.13 and prior to 3.1.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider auditing your Pandoc command usage and disallowing PDF output and the '--extract-media' option as a temporary workaround.
The CVSS score of CVE-2023-35936 is 5.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for haskell-pandoc.
