Listen to this Post
The vulnerability exploits the JavaScript engine within the gray-matter library, a dependency of md-to-pdf. Gray-matter parses YAML front-matter in Markdown files. When specific delimiters like `js` or `javascript` are used, the library’s embedded JavaScript engine is activated. This engine evaluates the content between these delimiters. An attacker can craft a malicious Markdown file where the front-matter contains a payload using these delimiters. When this file is processed by md-to-pdf, the gray-matter library interprets the payload as executable JavaScript code. This allows the attacker to break out of the data parsing context and achieve arbitrary code execution within the application process, for instance, by leveraging the `child_process` module to run system commands.
Platform: Node.js
Version: <5.0.0
Vulnerability: Code Injection
Severity: Critical
date: 2023-07-27
Prediction: 2023-08-10
What Undercode Say:
npm list gray-matter npm list md-to-pdf
const { mdToPdf } = require('md-to-pdf');
var payload = 'javascript\n((require("child_process")).execSync("id > /tmp/pwned"))\n';
(async () => {
await mdToPdf({ content: payload }, { dest: './output.pdf'});
})();
How Exploit:
Craft Markdown with `js` delimiter containing a Node.js payload to execute system commands when processed by a vulnerable md-to-pdf instance.
Protection from this CVE
Upgrade md-to-pdf to version 5.0.0 or later. Sanitize user-supplied Markdown by stripping or escaping front-matter delimiters before processing. Run the PDF conversion process with minimal privileges.
Impact:
Remote Code Execution
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
