office-converter through 1.0.2 OS Command Injection via fileName in generatePdf

Summary

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.

Evidence

The exploit was run against the published artifact from the registry, not the repository. It created a marker file; a benign input through the same sink in the same session did not.

Remediation

No fixed release was published at disclosure. Don't pass untrusted file names or strings to the affected functions, or apply the patch from the fix pull request.

References

• GitHub advisoryhttps://github.com/advisories/GHSA-9p64-h5q4-phpm
• VulnCheck advisoryhttps://www.vulncheck.com/advisories/office-converter-through-1.0.2-os-command-injection-via-filename-in-generatepdf
• Fix pull requesthttps://github.com/vworld4u/office-converter/pull/9
• Vulnerable codehttps://github.com/vworld4u/office-converter/blob/b1ea855d0001dc7a5d66343698634dbc06b72c2d/index.js#L19-L20
• CVE recordhttps://www.cve.org/CVERecord?id=CVE-2020-37282