Command Injection in office-converter Library

The office-converter npm package, versions 1.0.2 and earlier, contains a critical OS command injection vulnerability (CVE-2020-37282). The vulnerability exists within the generatePdf() and generateHtml() functions, which fail to properly sanitize the fileName parameter before passing it to the unoconv command. This command is invoked via the Node.js child_process.exec() method. By supplying a specially crafted file name containing shell metacharacters such as backticks, $(...), or closing quotes, an attacker can escape the intended parameter context and execute arbitrary system commands. Since the command is executed by the Node.js process, the attacker gains the execution context and privileges of the application running the library. This poses a significant risk to any web application or backend service utilizing the office-converter library for document conversion tasks.

Impact

The vulnerability allows for unauthenticated arbitrary command execution on the host system. If successfully exploited, an attacker could gain full control over the application server, leading to sensitive data exfiltration, system modification, or pivoting into internal networks. This vulnerability affects all applications that rely on the affected version of the office-converter library to process user-supplied file names or paths during document conversion.

Recommendation

• Immediately update the office-converter dependency to a version beyond 1.0.2.
• If updating is not immediately feasible, implement strict input validation on all file names passed to the generatePdf() and generateHtml() functions, ensuring no shell metacharacters (e.g., ;, |, &, $, `, ,) are permitted.
• Review logs for unusual process spawning activities stemming from the Node.js application process, such as unexpected child processes spawned by unoconv or shell interpreters like sh, bash, or cmd.exe.
• Apply the principle of least privilege by running the application process under a dedicated service account with minimal filesystem and network permissions.