Summary
pypdftk contains an OS command injection vulnerability in functions that construct PDF Toolkit commands from caller-supplied file paths. If an attacker can influence values such as pdf_path or out_file, shell metacharacters may be interpreted by the operating system, allowing commands to run with the privileges of the Python process.
pypdftk contains an OS command injection vulnerability in functions that construct PDF Toolkit commands from caller-supplied file paths. If an attacker can influence values such as pdf_path or out_file, shell metacharacters may be interpreted by the operating system, allowing commands to run with the privileges of the Python process.
Affected context
The vulnerability occurs in pypdftk deployments that use fill_form(), dump_data_fields(), or pdftk_cmd_util() with paths derived from untrusted or insufficiently constrained input. Risk is highest when those paths can be supplied through a network-facing application, uploaded-file workflow, job configuration, or other attacker-influenced interface, and when subprocess execution occurs with meaningful operating-system privileges.
The vulnerability occurs in pypdftk deployments that use fill_form(), dump_data_fields(), or pdftk_cmd_util() with paths derived from untrusted or insufficiently constrained input. Risk is highest when those paths can be supplied through a network-facing application, uploaded-file workflow, job configuration, or other attacker-influenced interface, and when subprocess execution occurs with meaningful operating-system privileges.
Exploit preconditions
- Attack surface: Application code that invokes pypdftk functions using caller-controlled path values
- Required access: Ability to influence
pdf_path,out_file, or another path passed into the affected command-building logic - Trigger point: Invocation of the affected PDF processing function
- Why exploitation is possible: The resulting command is passed to
subprocess.Popenwith shell interpretation enabled, allowing special shell syntax in untrusted values to alter command execution
- Attack surface: Application code that invokes pypdftk functions using caller-controlled path values
- Required access: Ability to influence
pdf_path,out_file, or another path passed into the affected command-building logic - Trigger point: Invocation of the affected PDF processing function
- Why exploitation is possible: The resulting command is passed to
subprocess.Popenwith shell interpretation enabled, allowing special shell syntax in untrusted values to alter command execution
Why this happens
The underlying flaw is the construction of shell commands by concatenating or embedding caller-supplied paths without adequately separating data from command syntax. Passing the resulting command to a process launcher with shell=True causes shell metacharacters in those values to be interpreted as instructions rather than treated strictly as filenames. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The underlying flaw is the construction of shell commands by concatenating or embedding caller-supplied paths without adequately separating data from command syntax. Passing the resulting command to a process launcher with shell=True causes shell metacharacters in those values to be interpreted as instructions rather than treated strictly as filenames. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The Python process and its accessible files or secrets could be compromised
- Application data may be modified, disclosed, or deleted
- A compromised service could be used for lateral movement or further system abuse
- Availability may be affected through destructive commands or resource consumption
- An attacker may execute arbitrary operating-system commands
- The Python process and its accessible files or secrets could be compromised
- Application data may be modified, disclosed, or deleted
- A compromised service could be used for lateral movement or further system abuse
- Availability may be affected through destructive commands or resource consumption
General mitigation guidance
Mitigation generally focuses on ensuring that external values remain data throughout process execution.
Common defensive patterns include:
- Invoke subprocesses without a shell and provide arguments as a structured list
- Treat file paths as untrusted data and apply strict path validation and canonicalization
- Constrain file access to approved directories and reject unexpected path forms
- Use secure-by-default wrappers that do not construct shell command strings
- Run PDF processing with a dedicated low-privilege account, restricted filesystem access, and limited operating-system capabilities
- Separate uploaded or user-controlled files from sensitive application and system locations
- Apply resource limits and isolation around external PDF-processing utilities
Mitigation generally focuses on ensuring that external values remain data throughout process execution.
Common defensive patterns include:
- Invoke subprocesses without a shell and provide arguments as a structured list
- Treat file paths as untrusted data and apply strict path validation and canonicalization
- Constrain file access to approved directories and reject unexpected path forms
- Use secure-by-default wrappers that do not construct shell command strings
- Run PDF processing with a dedicated low-privilege account, restricted filesystem access, and limited operating-system capabilities
- Separate uploaded or user-controlled files from sensitive application and system locations
- Apply resource limits and isolation around external PDF-processing utilities
How teams detect issues like this
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for
subprocesscalls usingshell=True, especially where command strings contain variables or formatted paths - Identify string concatenation, interpolation, or templating used to build process commands
- Review all data flows from HTTP parameters, uploaded filenames, job metadata, and configuration into subprocess arguments
- Use static analysis policies that flag shell execution and require structured argument passing
- Monitor process creation from PDF-processing services and alert on unexpected child processes or command interpreters
- Add code-review checks requiring explicit trust-boundary analysis for external command invocation
Detection can combine source review, automated analysis, and runtime monitoring:
- Search for
subprocesscalls usingshell=True, especially where command strings contain variables or formatted paths - Identify string concatenation, interpolation, or templating used to build process commands
- Review all data flows from HTTP parameters, uploaded filenames, job metadata, and configuration into subprocess arguments
- Use static analysis policies that flag shell execution and require structured argument passing
- Monitor process creation from PDF-processing services and alert on unexpected child processes or command interpreters
- Add code-review checks requiring explicit trust-boundary analysis for external command invocation
