Summary
A critical OS command injection vulnerability in doc-recog allows crafted document paths supplied to recog() or tag() to be interpreted as shell commands.
When the affected PDF-reading flow passes a path to a shell-based pdftotext execution call, an attacker may execute commands with the privileges of the Node.js process.
A critical OS command injection vulnerability in doc-recog allows crafted document paths supplied to recog() or tag() to be interpreted as shell commands.
When the affected PDF-reading flow passes a path to a shell-based pdftotext execution call, an attacker may execute commands with the privileges of the Node.js process.
Affected context
The vulnerability affects doc-recog deployments through version 1.1.6 when document paths from an attacker-influenced source reach the recog() or tag() APIs. Risk exists where DocData._readPDF invokes pdftotext through a shell without adequately separating data from command arguments or restricting path contents.
The vulnerability affects doc-recog deployments through version 1.1.6 when document paths from an attacker-influenced source reach the recog() or tag() APIs. Risk exists where DocData._readPDF invokes pdftotext through a shell without adequately separating data from command arguments or restricting path contents.
Exploit preconditions
- Attack surface: Applications exposing document-recognition functionality through
recog()ortag() - Required access: Ability to supply or influence a document path processed by the application
- Trigger point: PDF text extraction in
DocData._readPDF - Why exploitation is possible: The supplied path is incorporated into a shell-based command, allowing shell metacharacters and command-substitution syntax to be interpreted rather than treated strictly as file-name data
- Attack surface: Applications exposing document-recognition functionality through
recog()ortag() - Required access: Ability to supply or influence a document path processed by the application
- Trigger point: PDF text extraction in
DocData._readPDF - Why exploitation is possible: The supplied path is incorporated into a shell-based command, allowing shell metacharacters and command-substitution syntax to be interpreted rather than treated strictly as file-name data
Why this happens
The underlying bug is OS command injection caused by passing attacker-influenced file-path data into a shell command without enforcing a strict separation between arguments and executable logic.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command. The insecure pattern occurs when a process-spawning API invokes a shell and concatenates or interpolates untrusted input into the command string.
The underlying bug is OS command injection caused by passing attacker-influenced file-path data into a shell command without enforcing a strict separation between arguments and executable logic.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command. The insecure pattern occurs when a process-spawning API invokes a shell and concatenates or interpolates untrusted input into the command string.
Potential impact
- Attackers may execute arbitrary operating-system commands
- The Node.js application process and its accessible data may be compromised
- Sensitive files, credentials, or environment variables could be disclosed
- The host or container could be altered or used for lateral movement
- Service availability and application integrity may be affected
- Attackers may execute arbitrary operating-system commands
- The Node.js application process and its accessible data may be compromised
- Sensitive files, credentials, or environment variables could be disclosed
- The host or container could be altered or used for lateral movement
- Service availability and application integrity may be affected
General mitigation guidance
Mitigation generally focuses on ensuring that document paths remain data rather than executable shell content.
Common defensive patterns include:
- Using direct process-spawning APIs that pass executable arguments separately and do not invoke a shell
- Applying strict path validation, canonicalization, and allowlisting before file access
- Restricting accepted inputs to expected file locations and permitted document types
- Avoiding string concatenation when constructing operating-system commands
- Running the Node.js service with the minimum filesystem, network, and process privileges required
- Isolating document-processing workers and applying read-only or sandboxed execution controls where practical
Mitigation generally focuses on ensuring that document paths remain data rather than executable shell content.
Common defensive patterns include:
- Using direct process-spawning APIs that pass executable arguments separately and do not invoke a shell
- Applying strict path validation, canonicalization, and allowlisting before file access
- Restricting accepted inputs to expected file locations and permitted document types
- Avoiding string concatenation when constructing operating-system commands
- Running the Node.js service with the minimum filesystem, network, and process privileges required
- Isolating document-processing workers and applying read-only or sandboxed execution controls where practical
How teams detect issues like this
Detection approaches can include:
- Static analysis rules for shell-enabled process execution and string interpolation involving user-controlled paths
- Code review checks for command construction through concatenation, templates, or shell wrappers
- Runtime monitoring for unexpected child processes, unusual command-line arguments, or document-processing processes accessing unrelated files
- Policy enforcement that requires non-shell process APIs and approved path-validation utilities
- Automated security scanning and dependency review to identify command-injection patterns in document-processing code
Detection approaches can include:
- Static analysis rules for shell-enabled process execution and string interpolation involving user-controlled paths
- Code review checks for command construction through concatenation, templates, or shell wrappers
- Runtime monitoring for unexpected child processes, unusual command-line arguments, or document-processing processes accessing unrelated files
- Policy enforcement that requires non-shell process APIs and approved path-validation utilities
- Automated security scanning and dependency review to identify command-injection patterns in document-processing code
