CVE-2021-43113

Vulnerability

A command injection vulnerability exists in iText 7 (and up to, but excluding, 7.1.17) within the GhostscriptHelper.java class. The CompareTool class fails to properly sanitize filenames passed to the Ghostscript command line, allowing an attacker to inject arbitrary parameters. Versions affected are 4.4.13.3 through 7.1.17 [1][3].

Exploitation

An attacker must be able to control the filename parameter passed to the CompareTool.compareVisually() method. The attack does not require authentication if the application exposes this method to untrusted input. By crafting a malicious filename containing shell metacharacters (e.g., a.pdf" -sstdout=hi.txt # ), the attacker can inject arbitrary Ghostscript command-line arguments [3]. The ITEXT_GS_EXEC environment variable must point to a valid Ghostscript executable for the command to be executed [3].

Impact

Successful exploitation allows the attacker to inject arbitrary parameters into the Ghostscript command line. This can lead to disabling security features (e.g., -dNOSAFER overriding -dSAFER) or redirecting output, potentially resulting in information disclosure or further system compromise depending on the Ghostscript version and capabilities [3]. The attacker achieves command injection within the context of the iText application.

Mitigation

The vulnerability is fixed in iText 7.1.17, released on November 14, 2021 [3][4]. Users should upgrade to version 7.1.17 or later. No workaround is publicly available for affected versions [1][4].