easy-pdf-merge 0.2.6 and Earlier Suffer Critical Command Injection Flaw

The National Vulnerability Database lists CVE-2020-37279 as a critical severity flaw in the easy-pdf-merge Node.js package. This vulnerability allows attackers to execute arbitrary operating system commands on systems running affected versions of the library. The issue stems from improper validation of user-supplied input within the software.

The flaw exists in versions 0.1.0 through 0.2.6 of the library created by developer karuppiah7890. According to the NVD record, the vulnerability receives a CVSS score of 9.2. This score categorizes the issue as Critical. The underlying weakness is identified as CWE-78, which relates to OS command injection issues.

Technical Details of the Vulnerability

The vulnerability arises because the library uses the Node.js child_process.exec() function to run shell commands. This method executes commands through a shell rather than directly, which introduces security risks if input is not properly sanitized. Attackers can exploit this by injecting specific shell metacharacters into various options provided to the library.

Specifically, the NVD description notes that attackers can inject metacharacters into the source paths, destination path, or maxHeap option. These inputs are processed by the shell, allowing the execution of unintended commands. The commands run with the same privileges as the Node.js process hosting the application. This means the level of access gained depends on how the application is deployed.

Affected Versions and Input Vectors

The affected versions include all releases from 0.1.0 up to and including 0.2.6. The library is designed to merge PDF files. Any application using these versions of easy-pdf-merge is potentially vulnerable to this injection attack.

Attackers supply file names or options containing specific characters to trigger the exploit. The source material identifies double quotes, semicolons, dollar signs followed by parentheses, and backticks as effective injection vectors. These characters allow the attacker to break out of the intended command and execute their own shell instructions. The library fails to neutralize these special characters before passing them to the shell.

What should you do?

Security teams should audit their Node.js projects for the presence of easy-pdf-merge. If the library is found, check the version number against the affected range. Applications using versions 0.1.0 through 0.2.6 are at risk. Since no fix is confirmed in the provided material, immediate mitigation steps are necessary to reduce exposure.

Review all code paths that utilize the merge function. Ensure that any user-controlled input destined for source paths, destination paths, or maxHeap options is strictly validated. Do not trust client-side input for these parameters. Consider implementing allowlists for file names and paths if possible. Monitor server logs for unexpected command executions or unusual process activity that might indicate an attempted exploit.