CVE-2018-3746

Vulnerability

The pdfinfojs NPM module versions <= 0.3.6 contains a command injection vulnerability in the getInfoSync and getInfo functions. The user-supplied filename is concatenated into a shell command string without sanitization, using exec and execSync functions from Node's child_process module [1][2]. This allows an attacker who can control the filename parameter to inject arbitrary shell commands.

Exploitation

An attacker must supply a malicious filename to the pdfinfo constructor, which gets placed into the additional options array and passed directly to exec / execSync via the command template pdfinfo . No authentication or special privilege is needed beyond the ability to pass a crafted filename to the module. The attacker can leverage shell metacharacters such as backticks or $() in the filename string to execute arbitrary commands [1][2][3].

Impact

Successful command injection allows the attacker to execute arbitrary operating system commands with the privileges of the Node.js process. This can lead to full compromise of the host, including data exfiltration, installation of malware, or lateral movement within the network [1][2].

Mitigation

The vulnerability is fixed in version 0.4.1, released shortly after the disclosure. The fix replaces exec / execSync with execFile / execFileSync, which do not interpret shell metacharacters, and passes the filename as a separate argument rather than concatenated into the command string [2][3]. Users should upgrade to pdfinfojs >= 0.4.1. No workaround is provided for older versions.