Summary
Turnpress contains an OS command injection vulnerability in its DOCX-to-HTML conversion workflow. When a crafted DOCX filename is supplied during conversion or creation, shell metacharacters may be interpreted and allow command execution with the privileges of the victim process.
Turnpress contains an OS command injection vulnerability in its DOCX-to-HTML conversion workflow. When a crafted DOCX filename is supplied during conversion or creation, shell metacharacters may be interpreted and allow command execution with the privileges of the victim process.
Affected context
The issue occurs in Turnpress deployments through version 0.4.2 when DOCX files are processed by the converter component. Risk is present where an attacker can supply or influence a DOCX filename and the application invokes Pandoc through a shell-enabled process execution path during document conversion or creation.
The issue occurs in Turnpress deployments through version 0.4.2 when DOCX files are processed by the converter component. Risk is present where an attacker can supply or influence a DOCX filename and the application invokes Pandoc through a shell-enabled process execution path during document conversion or creation.
Exploit preconditions
- Attack surface: DOCX upload or document-processing functionality
- Required access: Ability to submit or influence a DOCX file name
- Trigger point: The
convertDocxToHtmlfunction during conversion or creation - Why exploitation is possible: The converter invokes Pandoc with shell execution enabled, allowing shell metacharacters in the document path to be interpreted by the command shell
- Attack surface: DOCX upload or document-processing functionality
- Required access: Ability to submit or influence a DOCX file name
- Trigger point: The
convertDocxToHtmlfunction during conversion or creation - Why exploitation is possible: The converter invokes Pandoc with shell execution enabled, allowing shell metacharacters in the document path to be interpreted by the command shell
Why this happens
The vulnerability results from constructing a shell command with attacker-influenced file-path data while enabling shell interpretation. Rather than passing the executable and arguments through a non-shell process interface, the application permits filename content to reach a command shell. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
The vulnerability results from constructing a shell command with attacker-influenced file-path data while enabling shell interpretation. Rather than passing the executable and arguments through a non-shell process interface, the application permits filename content to reach a command shell. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection.
Potential impact
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the Turnpress process
- Application data or local files could be accessed, modified, or deleted
- The service could be used to affect connected systems or process additional content
- Availability, confidentiality, and integrity could be impacted
- An attacker may execute arbitrary operating-system commands
- Commands could run with the privileges of the Turnpress process
- Application data or local files could be accessed, modified, or deleted
- The service could be used to affect connected systems or process additional content
- Availability, confidentiality, and integrity could be impacted
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from document-processing commands and reducing trust in file metadata.
Common defensive patterns include:
- Invoke Pandoc through an argument-array or equivalent non-shell API
- Treat uploaded filenames as untrusted data and generate controlled internal names
- Validate filenames against a narrow allowlist and reject unexpected path or shell characters
- Keep uploaded files outside executable or sensitive directories
- Run conversion workers with least-privilege accounts and restricted filesystem access
- Apply resource, network, and process isolation to document conversion workloads
Mitigation generally focuses on removing shell interpretation from document-processing commands and reducing trust in file metadata.
Common defensive patterns include:
- Invoke Pandoc through an argument-array or equivalent non-shell API
- Treat uploaded filenames as untrusted data and generate controlled internal names
- Validate filenames against a narrow allowlist and reject unexpected path or shell characters
- Keep uploaded files outside executable or sensitive directories
- Run conversion workers with least-privilege accounts and restricted filesystem access
- Apply resource, network, and process isolation to document conversion workloads
How teams detect issues like this
Detection approaches may include:
- Static analysis rules identifying shell-enabled process execution
- Code review checks for user-controlled filenames interpolated into command strings
- Searches for
shell: trueor equivalent options near upload and conversion code - Tests using benign metacharacter-like filename cases to verify that arguments remain data
- Runtime monitoring for unexpected child processes, command interpreters, or unusual file activity from conversion workers
- CI policy enforcement requiring non-shell process APIs for externally influenced inputs
Detection approaches may include:
- Static analysis rules identifying shell-enabled process execution
- Code review checks for user-controlled filenames interpolated into command strings
- Searches for
shell: trueor equivalent options near upload and conversion code - Tests using benign metacharacter-like filename cases to verify that arguments remain data
- Runtime monitoring for unexpected child processes, command interpreters, or unusual file activity from conversion workers
- CI policy enforcement requiring non-shell process APIs for externally influenced inputs
