CVE-2020-37282: office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via childprocess.exec(), executing commands with Node.js process privileges.
Affected Software
Event History
Frequently Asked Questions
What applications are exposed to this vulnerability?
Applications using npm/office-converter through version 1.0.2 are exposed if they pass attacker-controlled file names to generatePdf() or generateHtml(). The injected command runs with the privileges of the Node.js process.
What does an attacker need to exploit it?
An attacker needs to supply a crafted fileName value to generatePdf() or generateHtml(). Payloads can use command substitution such as $(...) or backticks, or a closing quote followed by shell metacharacters.
Is authentication or user interaction required?
No. The supplied severity vector indicates network exploitation with low attack complexity and no privileges or user interaction required.
How can I determine whether my application is affected?
Check whether your application depends on office-converter version 1.0.2 or earlier and whether untrusted input can reach the fileName argument of generatePdf() or generateHtml(). The vulnerable code constructs an unoconv command and executes it through child_process.exec().