CVE-2021-3342
📋 TL;DR
CVE-2021-3342 is a critical vulnerability in EPrints 3.4.2 that allows remote attackers to read arbitrary files and potentially execute commands on the server. Attackers exploit this by sending crafted LaTeX input to the cgi/latex2png endpoint. Any organization running vulnerable EPrints installations is affected.
💻 Affected Systems
- EPrints
📦 What is this software?
Eprints by Eprints
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Arbitrary file reading exposing sensitive configuration files, credentials, and user data, followed by command execution.
If Mitigated
Limited impact with proper input validation and file system restrictions in place.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code targeting the latex2png endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EPrints 3.4.3 or later
Vendor Advisory: https://files.eprints.org/2548/
Restart Required: No
Instructions:
1. Upgrade to EPrints 3.4.3 or later. 2. Apply the security patch from the vendor advisory. 3. Verify the latex2png script no longer processes dangerous LaTeX commands.
🔧 Temporary Workarounds
Disable latex2png endpoint
linuxRemove or restrict access to the vulnerable CGI script
mv /var/www/eprints/cgi/latex2png /var/www/eprints/cgi/latex2png.disabled
chmod 000 /var/www/eprints/cgi/latex2png.disabled
Web server access control
allBlock access to the vulnerable URI using web server configuration
# Apache: <Location "/cgi/latex2png">
Order deny,allow
Deny from all
</Location>
# Nginx: location ~ ^/cgi/latex2png { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate EPrints servers from sensitive systems
- Deploy a web application firewall (WAF) with rules to block malicious LaTeX input patterns
🔍 How to Verify
Check if Vulnerable:
Test if the /cgi/latex2png?latex= endpoint accepts and processes LaTeX input containing file read or command injection attemptsCheck Version:
grep '\$version' /path/to/eprints/archives/*/cfg/cfg.d/*.pl | head -1Verify Fix Applied:
Verify the patch prevents file read attempts and command execution via the latex2png endpoint📡 Detection & Monitoring
Log Indicators:
- Unusual POST/GET requests to /cgi/latex2png with LaTeX commands
- System command execution from web server process
- File read attempts from unexpected locations
Network Indicators:
- HTTP requests containing LaTeX commands like \input, \write18, or file paths
SIEM Query:
source="web_server_logs" AND uri="/cgi/latex2png" AND (query="*latex=*" OR method="POST")