OS Command Injection in easy-pdf-merge

The npm package 'easy-pdf-merge' (versions 0.1.0 through 0.2.6) is vulnerable to OS command injection due to improper handling of user-supplied input. An attacker can exploit this by injecting shell metacharacters such as double quotes, semicolons, dollar-parenthesis sequences $(), or backticks into the 'source' paths, 'destination' path, or 'maxHeap' option. These inputs are passed directly to the 'child_process.exec()' function in Node.js, which interprets them as shell commands. As a result, the injected commands are executed with the privileges of the Node.js application process. This vulnerability (CVE-2020-37279) presents a significant risk to any environment hosting applications that process user-defined PDF merge requests, as it allows for full remote code execution on the underlying host.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary system commands on the server running the vulnerable application. This may lead to total system compromise, exfiltration of sensitive data, or the establishment of persistent backdoors within the environment. Affected sectors include any organization utilizing Node.js applications that leverage the easy-pdf-merge library for document processing tasks.

Recommendation

• Immediately update the 'easy-pdf-merge' package to a version beyond 0.2.6.
• If updating is not feasible, implement strict input validation and sanitization for all parameters passed to the library, ensuring the removal of shell metacharacters before processing.
• Audit applications utilizing this package for unauthorized child process execution using endpoint telemetry.