CVE-2020-18750
📋 TL;DR
CVE-2020-18750 is a buffer overflow vulnerability in pdf2json version 0.69 that allows local users to execute arbitrary code by converting a malicious PDF file. This affects systems where pdf2json is installed and users can process untrusted PDF files. The vulnerability requires local access to trigger the exploit.
💻 Affected Systems
- pdf2json
📦 What is this software?
Pdf2json by Flowpaper
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary code execution as the user running pdf2json, potentially leading to privilege escalation or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution within the context of the user running the vulnerable pdf2json process.
If Mitigated
No impact if proper access controls prevent local users from executing pdf2json with untrusted PDF files.
🎯 Exploit Status
Exploit requires local access and ability to run pdf2json with a crafted PDF file. The buffer overflow is straightforward to trigger with proper knowledge of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 80bf71f16c804108fd933e267fe31692aaa509b4
Vendor Advisory: https://github.com/flexpaper/pdf2json/commit/80bf71f16c804108fd933e267fe31692aaa509b4
Restart Required: No
Instructions:
1. Update pdf2json to version after commit 80bf71f16c804108fd933e267fe31692aaa509b4. 2. If using source, pull latest from GitHub repository. 3. Recompile if using compiled version.
🔧 Temporary Workarounds
Restrict pdf2json execution
linuxLimit which users can execute pdf2json to prevent untrusted users from triggering the vulnerability
chmod 750 /usr/local/bin/pdf2json
setfacl -m u:trusteduser:rx /usr/local/bin/pdf2json
Sandbox pdf2json execution
allRun pdf2json in a container or sandboxed environment to limit impact if exploited
docker run --rm -v $(pwd):/data pdf2json pdf2json -f input.pdf -o output.json
🧯 If You Can't Patch
- Restrict access to pdf2json binary to only trusted users
- Implement strict input validation for PDF files before processing with pdf2json
🔍 How to Verify
Check if Vulnerable:
Check if pdf2json version is 0.69: pdf2json --version or check installed package versionCheck Version:
pdf2json --version 2>/dev/null || dpkg -l | grep pdf2json || rpm -qa | grep pdf2jsonVerify Fix Applied:
Verify commit hash includes 80bf71f16c804108fd933e267fe31692aaa509b4 or version is newer than 0.69📡 Detection & Monitoring
Log Indicators:
- Multiple pdf2json process crashes
- Unusual PDF file processing patterns
- Suspicious command execution following pdf2json runs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
process_name="pdf2json" AND (event_type="process_crash" OR cmdline="*pdf2json*" AND cmdline="*.pdf*")