Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical vulnerability in office-converter software related to OS command injection. The issue stems from how the software handles file names when converting documents, allowing attackers to execute commands on the underlying system by embedding malicious commands within the file name. This could potentially lead to unauthorized access and control over the affected Node.js environment.
- A file name flaw allows unauthorized command execution.
- Impacts systems processing documents via this converter.
- Confirm relevance and exposure of this software.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this by sending a specially crafted file name to a service that uses the office-converter library. This malicious file name, when processed by the `generatePdf()` or `generateHtml()` functions, would allow the attacker to execute arbitrary commands on the server, leveraging the underlying `unoconv` command.
- Attacker needs to send a crafted file name.
- Vulnerable function is `generatePdf()` or `generateHtml()`.
- Risk is arbitrary command execution.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, an attacker could execute arbitrary commands on the system running the vulnerable application by supplying a malicious file name. This could allow them to perform actions with the privileges of the Node.js process.
- System commands could be executed.
- Malicious file names may be supplied.
- Arbitrary command execution is possible.
Operational Fix
Recommended remediation, mitigation, and detection steps
The office-converter library's OS command injection vulnerability likely affects application owners responsible for integrating document conversion features. The first step is to identify all instances of this library, determine their exposure, and confirm business criticality. Subsequently, the accountable owner should be identified to plan remediation, which may involve vendor coordination or code updates.
- Application owners should lead remediation efforts.
- Verify affected services and exposure.
- Plan updates or vendor coordination.
