Summary
xhtml2pdf contains an OS command injection vulnerability in pisa.startViewer() because file names are interpolated into a shell command without adequate escaping.
When the viewer option is enabled and an attacker can influence the input file name, crafted metadata may cause commands to execute with the privileges of the invoking process.
xhtml2pdf contains an OS command injection vulnerability in pisa.startViewer() because file names are interpolated into a shell command without adequate escaping.
When the viewer option is enabled and an attacker can influence the input file name, crafted metadata may cause commands to execute with the privileges of the invoking process.
Affected context
The vulnerability affects xhtml2pdf deployments that use the pisa viewer functionality through the -s or --start-viewer option. It becomes risky when an attacker can provide or influence an input file whose name is incorporated into the viewer command, particularly in versions before 0.2.19.
The vulnerability affects xhtml2pdf deployments that use the pisa viewer functionality through the -s or --start-viewer option. It becomes risky when an attacker can provide or influence an input file whose name is incorporated into the viewer command, particularly in versions before 0.2.19.
Exploit preconditions
- Attack surface: The
pisa.startViewer()viewer-launching functionality - Required access: Ability to submit or influence an input file name processed by the application
- Trigger point: Viewer startup when
-sor--start-vieweris used - Why exploitation is possible: Unescaped file-name data is interpolated into a command executed through the operating system shell
- Attack surface: The
pisa.startViewer()viewer-launching functionality - Required access: Ability to submit or influence an input file name processed by the application
- Trigger point: Viewer startup when
-sor--start-vieweris used - Why exploitation is possible: Unescaped file-name data is interpolated into a command executed through the operating system shell
Why this happens
The underlying issue is the construction of a shell command using attacker-influenced file-name data without treating that data as strictly non-executable.
Passing interpolated values to os.system() allows shell metacharacters and quoting constructs to alter command interpretation. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
The underlying issue is the construction of a shell command using attacker-influenced file-name data without treating that data as strictly non-executable.
Passing interpolated values to os.system() allows shell metacharacters and quoting constructs to alter command interpretation. This maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly called OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the invoking application
- The host or container may be compromised
- Sensitive files or environment data could be exposed
- The vulnerable process could be used for persistence or lateral movement
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the invoking application
- The host or container may be compromised
- Sensitive files or environment data could be exposed
- The vulnerable process could be used for persistence or lateral movement
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file-name inputs.
Common defensive patterns include:
- Prefer direct process-execution APIs that pass arguments as structured values rather than invoking a shell
- Avoid constructing commands through string interpolation
- Validate file names against a restrictive allowlist of expected characters and formats
- Treat uploaded or externally supplied file names as untrusted metadata
- Use fixed executable paths and fixed viewer options where possible
- Run the rendering process with a dedicated low-privilege account and minimal filesystem permissions
- Disable viewer-launching functionality when it is not required
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file-name inputs.
Common defensive patterns include:
- Prefer direct process-execution APIs that pass arguments as structured values rather than invoking a shell
- Avoid constructing commands through string interpolation
- Validate file names against a restrictive allowlist of expected characters and formats
- Treat uploaded or externally supplied file names as untrusted metadata
- Use fixed executable paths and fixed viewer options where possible
- Run the rendering process with a dedicated low-privilege account and minimal filesystem permissions
- Disable viewer-launching functionality when it is not required
How teams detect issues like this
Detection approaches may include:
- Static analysis rules identifying
os.system()or shell execution with concatenated or formatted input - Code review checks for file names, paths, or request values embedded in command strings
- Tests using benign shell-special-character variants to verify that inputs remain data
- Runtime monitoring for unexpected child processes launched by rendering services
- Policy enforcement that prohibits shell-based process execution in request-handling code
Automated security review tools can help identify unsafe command construction patterns, but findings should be validated against actual data flow and deployment behavior.
Detection approaches may include:
- Static analysis rules identifying
os.system()or shell execution with concatenated or formatted input - Code review checks for file names, paths, or request values embedded in command strings
- Tests using benign shell-special-character variants to verify that inputs remain data
- Runtime monitoring for unexpected child processes launched by rendering services
- Policy enforcement that prohibits shell-based process execution in request-handling code
Automated security review tools can help identify unsafe command construction patterns, but findings should be validated against actual data flow and deployment behavior.
