I have discovered a security vulnerability that allows a malicious actor to inject arbitrary shell commands into a system running `ocrfeeder` with automatic `unpaper` pre-processing enabled.
Proof of concept:
- Create a PDF file with the name `foo; nautilus; bar.pdf`
- Open `ocrfeeder`
- Ensure that settings -> tools -> unpaper images is checked
- Import the PDF file
- `nautilus` is started (If your particular system doesn't have nautilus, you can use any other executable here)
The vulnerability presents itself as follows: When `ocrfeeder` generates the temporary file as an input for `unpaper`, it keeps the name of the originally imported PDF intact (see https://gitlab.gnome.org/GNOME/ocrfeeder/-/blob/master/src/ocrfeeder/util/lib.py#L182). `unpaper` is then called on this temporary file: In https://gitlab.gnome.org/GNOME/ocrfeeder/-/blob/master/src/ocrfeeder/util/lib.py#L189, the file names for input and output are concatenated to a command string. This string is subsequently passed to `os.system()`, i.e., executed in a fully-featured shell. No escaping or quoting of any kind is used, hence, arbitrary control characters can be injected into the command through the file name of the initial PDF. Especially, spaces and semicolons will be parsed, allowing to break out of the file name and execute arbitrary commands on the shell.
Since `ocrfeeder-cli` does not support `unpaper` as far as I understand, exploiting this vulnerability requires the user to explicitly import the malicious file, which leads me to believe that zero-click exploitation is not possible at the moment.
I have also reported this issue to https://gitlab.gnome.org/GNOME/ocrfeeder .
Metadata:
system: Ubuntu 20.04.4 LTS
affected package version: ocrfeeder 0.8.1+git20200128.b945089-1ubuntu1
Digging further, I was able to expand on this. ocrfeeder also uses Python's subprocess.run(cmd, shell=True) when it converts pdf files to images (see https:/
Proof of Concept:
- keep settings -> tools -> unpaper images turned OFF
- create a PDF file with name `foo$(nautilus)
- Import the PDF file
- `nautilus` is started
The vulnerability causes the subshell to be started when orcfeeder invokes `gs` to convert the PDF file into individual images. This vector is slightly more effective, since it doesn't require the user to have the unpaper option turned on.
EDIT: This was apparently fixed upstream in https:/