Summary
A critical OS command injection vulnerability in office-converter allows attacker-controlled file names to influence a shell command used during document conversion. When a crafted file name reaches the conversion functions, commands may execute with the privileges of the Node.js process.
A critical OS command injection vulnerability in office-converter allows attacker-controlled file names to influence a shell command used during document conversion. When a crafted file name reaches the conversion functions, commands may execute with the privileges of the Node.js process.
Affected context
The vulnerability occurs in office-converter deployments through version 1.0.2 when the generatePdf() or generateHtml() functions accept file names that are not strictly constrained before being incorporated into an unoconv command. Risk depends on whether an attacker can influence the file name and whether the application invokes the conversion functionality with a shell-enabled process execution API.
The vulnerability occurs in office-converter deployments through version 1.0.2 when the generatePdf() or generateHtml() functions accept file names that are not strictly constrained before being incorporated into an unoconv command. Risk depends on whether an attacker can influence the file name and whether the application invokes the conversion functionality with a shell-enabled process execution API.
Exploit preconditions
- Attack surface: The document conversion API exposed by
generatePdf()orgenerateHtml() - Required access: Ability to supply or influence the file name passed to a conversion function
- Trigger point: Construction and execution of the
unoconvcommand - Why exploitation is possible: User-controlled file-name data is concatenated into a shell command and executed through Node.js process privileges without adequate command separation or shell metacharacter handling
- Attack surface: The document conversion API exposed by
generatePdf()orgenerateHtml() - Required access: Ability to supply or influence the file name passed to a conversion function
- Trigger point: Construction and execution of the
unoconvcommand - Why exploitation is possible: User-controlled file-name data is concatenated into a shell command and executed through Node.js process privileges without adequate command separation or shell metacharacter handling
Why this happens
The underlying flaw is OS command injection, mapped to CWE-78. The application treats a file name as ordinary data while embedding it directly into a command string executed by a shell-oriented process API. Because the input is not reliably separated from command syntax or constrained to a safe file-name representation, shell interpretation can cause attacker-controlled expressions to be processed as commands.
The underlying flaw is OS command injection, mapped to CWE-78. The application treats a file name as ordinary data while embedding it directly into a command string executed by a shell-oriented process API. Because the input is not reliably separated from command syntax or constrained to a safe file-name representation, shell interpretation can cause attacker-controlled expressions to be processed as commands.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The application process could be compromised with its available privileges
- Sensitive files, environment variables, or credentials may be exposed
- The host or container could be used for lateral movement
- Application data may be modified, deleted, or disrupted
- An attacker may execute arbitrary operating-system commands
- The application process could be compromised with its available privileges
- Sensitive files, environment variables, or credentials may be exposed
- The host or container could be used for lateral movement
- Application data may be modified, deleted, or disrupted
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from document conversion workflows and reducing trust in file-name input.
Common defensive patterns include:
- Prefer direct process-spawn APIs that pass arguments separately rather than constructing shell command strings
- Apply strict allowlist validation for file names and reject path separators, control characters, and shell syntax
- Generate server-side temporary names instead of accepting client-controlled names where feasible
- Use fixed executable paths and constrained argument sets for conversion tools
- Run conversion workers with least privilege, isolated filesystem access, and limited network permissions
- Avoid exposing conversion operations without appropriate authorization and resource controls
Mitigation generally focuses on removing shell interpretation from document conversion workflows and reducing trust in file-name input.
Common defensive patterns include:
- Prefer direct process-spawn APIs that pass arguments separately rather than constructing shell command strings
- Apply strict allowlist validation for file names and reject path separators, control characters, and shell syntax
- Generate server-side temporary names instead of accepting client-controlled names where feasible
- Use fixed executable paths and constrained argument sets for conversion tools
- Run conversion workers with least privilege, isolated filesystem access, and limited network permissions
- Avoid exposing conversion operations without appropriate authorization and resource controls
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis rules for string concatenation or interpolation passed to shell-enabled process execution APIs
- Code review checks for user-controlled file names used in command construction
- Taint analysis tracing request parameters into
exec, shell wrappers, or equivalent APIs - Runtime monitoring for unexpected child processes, command interpreters, or unusual conversion-tool arguments
- Policy enforcement requiring argument-separated process execution and centralized input validation
- Automated security review tools that flag command construction from untrusted data
Organizations can identify this class of issue through:
- Static analysis rules for string concatenation or interpolation passed to shell-enabled process execution APIs
- Code review checks for user-controlled file names used in command construction
- Taint analysis tracing request parameters into
exec, shell wrappers, or equivalent APIs - Runtime monitoring for unexpected child processes, command interpreters, or unusual conversion-tool arguments
- Policy enforcement requiring argument-separated process execution and centralized input validation
- Automated security review tools that flag command construction from untrusted data
