Patch easy-pdf-merge to Stop Critical Command Injection in Node.js Apps

The open-source Node.js library easy-pdf-merge contains a critical OS command injection vulnerability. The flaw, identified as CVE-2020-37279, allows attackers to execute commands by injecting shell metacharacters. According to the National Vulnerability Database, the issue stems from how the library handles user-supplied input when constructing shell commands for merging PDF files.

Root cause

The underlying weakness is classified as CWE-78, which refers to the use of operating system commands in a way that allows shell metacharacters to be treated as active commands. The easy-pdf-merge library passes file paths and options directly to the Node.js `child_process.exec()` function. This function executes commands through a system shell. When the library does not sanitize inputs containing special characters, the shell interprets those characters as command separators or execution triggers.

Attack path

An attacker can exploit this vulnerability by supplying malicious input in the source paths, destination path, or the `maxHeap` option. The National Vulnerability Database notes that attackers can inject shell metacharacters such as double quotes, semicolons, backticks, or `$()` syntax. When the library processes these inputs, the `child_process.exec()` function runs the injected code through the shell. The resulting commands execute with the Node.js process privileges.

Affected versions

The vulnerability affects all versions of easy-pdf-merge from 0.1.0 up to and including 0.2.6. The NVD record lists "karuppiah7890" in the affected field. Any application that imports this library and passes user-controlled data to its merge functions is potentially vulnerable. No fix has been confirmed yet.

Mitigation

• Remove the easy-pdf-merge library from production environments until a secure alternative is identified.
• Validate all file path inputs to ensure they contain only expected characters and do not include shell metacharacters.
• Avoid using `child_process.exec()` for operations that involve user-supplied data.
• Monitor server logs for unexpected command execution or unusual process spawning patterns.

What to do and how to stay safe: easy-pdf-merge

• Audit your Node.js project dependencies to identify if you are using easy-pdf-merge versions 0.1.0 through 0.2.6.
• Implement strict input validation on all file paths and configuration options passed to PDF manipulation libraries.
• Replace usage of shell-executing functions with safer alternatives that do not invoke a shell for command execution.
• Watch for indicators of compromise such as new processes spawning from your Node.js application unexpectedly.

Step-by-step guide: Vulnerability Management Definition and Process

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2020-37279?

The National Vulnerability Database rates CVE-2020-37279 as Critical with a CVSS score of 9.2.

Which versions of easy-pdf-merge are affected by this vulnerability?

The vulnerability affects easy-pdf-merge versions 0.1.0 through 0.2.6.

How do attackers exploit this command injection flaw?

Attackers inject shell metacharacters like semicolons or backticks into source paths, destination paths, or the maxHeap option.