OS Command Injection in Office Converter via File Name

Executive Summary

This vulnerability is an OS command injection flaw in the office-converter npm package through version 1.0.2. It allows attackers to execute arbitrary commands by supplying a malicious file name to generatePdf() or generateHtml(). The file name is concatenated into a shell command run via child_process.exec(), enabling command substitution like $(touch canary.txt) or backticks to execute unintended commands with Node.js process privileges.

Useful 0 Not Useful 0

Detection Guidance

Check for vulnerable versions of office-converter by inspecting package.json or running npm list office-converter. Look for files with suspicious names like $(touch canary.txt) or backticks in filenames. Monitor for unexpected child_process.exec calls in the application code.

Useful 0 Not Useful 0

Impact Analysis

If you use the vulnerable office-converter package, attackers could exploit this flaw by uploading a file with a specially crafted name. This could allow them to run arbitrary commands on your server with the same privileges as the Node.js process. This may lead to data theft, system compromise, or further network infiltration depending on the server's environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using this package may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Stop using office-converter immediately. Replace it with an alternative module as no patch is available. If removal is not possible, implement strict input validation for filenames and avoid using child_process.exec. Use child_process.execFile instead.

Useful 0 Not Useful 0