Authenticated File Read in ConvertX via Pandoc Sandbox Bypass

Executive Summary

ConvertX through version 0.19.0 has an arbitrary file read vulnerability because it uses Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive pointing to an absolute path, convert it, and download output containing the referenced file's contents.

Useful 0 Not Useful 0

Detection Guidance

Check if ConvertX is running without the --sandbox flag in Pandoc commands. Inspect the pandoc.ts file in the ConvertX source code for the absence of --sandbox in the command construction. Look for unusual file reads in server logs, especially after users upload reStructuredText files with absolute path include directives.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users to read sensitive server files such as configuration files, application source code, database files, or other users' files. Confidentiality is breached as attackers can access restricted data on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA by exposing sensitive personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update ConvertX to a patched version that includes the --sandbox flag in Pandoc commands. If no patch is available, manually edit src/converters/pandoc.ts to add --sandbox to the Pandoc argument list. Restrict file permissions to limit access to sensitive files. Monitor for unauthorized file access attempts.

Useful 0 Not Useful 0