CVE-2020-37279: easy-pdf-merge 0.2.6 Path Injection Grants Node.js Process Privileges to Attackers
The National Vulnerability Database rates CVE-2020-37279 as critical, noting that attackers can execute system commands by injecting specific characters into file paths or options.
Key points
- easy-pdf-merge versions 0.1.0 through 0.2.6 contain an OS command injection flaw.
- Attackers can inject shell metacharacters into source paths, destination paths, or the maxHeap option.
- The vulnerability enables command execution with the privileges of the Node.js process.
The open-source Node.js package easy-pdf-merge contains a severe security flaw that allows remote attackers to execute arbitrary system commands. The National Vulnerability Database records this issue as CVE-2020-37279 and assigns it a CVSS score of 9.2, classifying it as critical. This vulnerability affects versions 0.1.0 through 0.2.6, which were published by the maintainer karuppiah7890.
Root cause
The underlying issue is an OS command injection vulnerability, categorised under CWE-78. The package fails to properly sanitise user-supplied input before passing it to the operating system shell. Specifically, the library uses the child_process.exec() function, which interprets input as shell commands. This design choice creates a direct path for attackers to inject malicious code if they can control the arguments passed to the merge function.
Attack path
Attackers can exploit this flaw by supplying file names or configuration options containing specific shell metacharacters. According to the NVD record, these characters include double quotes, semicolons, dollar signs followed by parentheses, and backticks. When these characters are included in the source path, destination path, or the maxHeap option, the shell interprets them as command separators or execution triggers. This allows the injection of arbitrary commands that run with the same privileges as the Node.js process.
Affected versions
The vulnerability exists in all releases of easy-pdf-merge from version 0.1.0 up to and including version 0.2.6. Any application relying on these specific versions of the package is potentially exposed to command injection attacks if user-controlled data is passed to the merge functionality.
Mitigation
- Update the easy-pdf-merge package to a version newer than 0.2.6, if a patched release is available from the vendor.
- Audit codebases for usage of easy-pdf-merge versions 0.1.0 through 0.2.6.
- Avoid passing user-supplied input directly to the source path, destination path, or maxHeap options.
- Implement strict input validation to reject strings containing shell metacharacters such as backticks or semicolons.
Background: Command injection
Command injection occurs when an application passes unsanitised user input to a system shell. The shell interprets this input as executable instructions rather than data. This allows attackers to run arbitrary commands on the host server, potentially leading to full system compromise or data exfiltration.
Read the full guide: Command Injection: How Unsanitised Input Breaks Your Shell
What to do and how to stay safe
- Review your dependency tree to identify if any project uses easy-pdf-merge versions 0.1.0 to 0.2.6.
- Isolate Node.js processes running this package to limit the potential impact of command execution.
- Monitor system logs for unexpected command executions or new files created in temporary directories.
- Once the vendor provides an update, test it in a staging environment before deploying to production.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2020-37279?
The National Vulnerability Database rates the vulnerability as 9.2, which is classified as critical.
