Fixed Remote Code Execution Vulnerability

[mufeedvh]

⚙️ Fix:

The PDFImage() function doesn't validate the input of pdfFilePath input parameter. The pdfFilePath parameter accepts the path of the PDF file which is then used in a system command execution which when given without validation will result in a Remote Code Execution (RCE) Vulnerability.

What the fix does is: It validates the pdfFilePath input and checks for characters that can be used to concatenate any other system commands.

❓ How:

The mitigation is implemented with a Regex (/;|&|`|\$|\(|\)|\|\||\||!|>|<|\?|\${/g) check for invalid characters in index.js

📎 Proof of Concept (PoC):

poc.js (put inside the node-pdf-image folder)

var PDFImage = require('.').PDFImage;

var pdfImage = new PDFImage('"; sleep 500 #"');
pdfImage.getInfo();

🔥 Fix On Action:

OSX:

$ brew install imagemagick ghostscript poppler

Linux (Ubuntu):

$ sudo apt-get install imagemagick ghostscript poppler-utils

Run PoC To Test Fix:

$ npm install
$ node poc.js

❤️ After Fix:

---

✌️ Fixed!

---

[toufik-airane]

Dear @mufeedvh,

Thank you for your contribution.

The regexp isn't easily readable and so maintainable and especially two parts of the expression.
Can you ease the regular expression or at least document it?

Best regards.

[toufik-airane]

The regexp isn't easily readable and so maintainable and especially two parts of the expression.
The first part is |\|\||\| and the second is |\${.

[adam-nygate]

Also, it looks like you're duplicating matches for $ symbols and pipes (matching both \|\| and \|). Feel free to revise and then we can accept the PR 🙂

[mufeedvh]

Hi,

Check out the revised commit, I just cleaned up the Regex to /[`!@#$%^&*()_+\-=\[\]{};':"\\|,<>\/?~]/ to filter out special characters except . to only accept filenames.

[toufik-airane]

Dear @mufeedvh,

You are restricting too many characters. Some characters seem not related to a command shell feature.

[toufik-airane]

Not all characters could trigger remote code execution.
You've blacklisted some harmful and probably legit one such as _ (underscore), ~ (tilde), etc.

I would only filter these characters, that have potential command shell feature:
;|`$()&<>

[mufeedvh]

Oh yeah didn't think about it. I did it in a hurry and was sleepy! 😅

[mufeedvh]

Done, fixed that! 👍

[adam-nygate]

LGTM 👍

[huntr-helper]

Congratulations @mufeedvh - your fix has been selected! 🎉

Thanks for being part of the community & helping secure the world's open source code.
If you have any questions, please respond in the comments section. Your bounty is on its way - keep hunting!