OS Command Injection in doc-recog via Malicious Document Path

Executive Summary

This is an OS command injection vulnerability in the doc-recog library versions up to 1.1.6. It allows attackers to execute arbitrary commands on the system by injecting command substitution syntax like $(...) or backticks into file paths passed to the recog() or tag() functions. The vulnerable DocData._readPDF function passes these paths to a shell-based pdftotext command execution via Node.js's exec call, running commands with the Node.js process privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if doc-recog versions up to 1.1.6 are installed using npm list doc-recog or by inspecting package.json. Look for processes using pdftotext with suspicious command substitutions like $(...) or backticks in file paths. Monitor logs for unexpected shell commands executed by Node.js processes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to run malicious commands on your system with the same privileges as the Node.js process. This could lead to unauthorized data access, system compromise, installation of malware, or disruption of services. The high CVSS scores (9.3 v4, 9.8 v3.1) indicate severe potential impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, data breaches, and potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade doc-recog to a patched version that replaces exec() with execFile() in DocData._readPDF. If upgrading is not possible, restrict file paths to trusted inputs and avoid passing user-controlled paths to recog() or tag(). Review other files like doctag.js, chain.js, and doctable.js for similar issues.

Useful 0 Not Useful 0