CVE-2022-23850
📋 TL;DR
CVE-2022-23850 is a stack-based buffer overflow vulnerability in epub2txt's xhtml_translate_entity function that allows remote code execution via a specially crafted EPUB document. This affects users who process untrusted EPUB files with epub2txt versions through 2.02. Attackers can exploit this to execute arbitrary code with the privileges of the epub2txt process.
💻 Affected Systems
- epub2txt (epub2txt2)
📦 What is this software?
Epub2txt by Epub2txt Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or pivot to other systems.
If Mitigated
Denial of service if exploit fails or is detected by security controls.
🎯 Exploit Status
Exploitation requires the victim to process a malicious EPUB file. Public proof-of-concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.03 and later
Vendor Advisory: https://github.com/kevinboone/epub2txt2/issues/17
Restart Required: No
Instructions:
1. Check current version with 'epub2txt --version'. 2. Update to version 2.03 or later from the GitHub repository. 3. Recompile if using source code.
🔧 Temporary Workarounds
Disable EPUB processing
linuxTemporarily disable epub2txt or block EPUB file processing until patched.
sudo mv /usr/bin/epub2txt /usr/bin/epub2txt.disabled
Use alternative EPUB tools
linuxReplace epub2txt with alternative EPUB processing tools like calibre or pandoc.
sudo apt-get install calibre
🧯 If You Can't Patch
- Implement strict file upload validation to reject suspicious EPUB files.
- Run epub2txt in a sandboxed environment with minimal privileges.
🔍 How to Verify
Check if Vulnerable:
Run 'epub2txt --version' and check if version is 2.02 or earlier.Check Version:
epub2txt --versionVerify Fix Applied:
Confirm version is 2.03 or later with 'epub2txt --version' and test with known safe EPUB files.📡 Detection & Monitoring
Log Indicators:
- Segmentation faults or abnormal termination of epub2txt process
- Unusual process spawning from epub2txt
Network Indicators:
- Outbound connections from epub2txt process to unknown destinations
SIEM Query:
process_name:epub2txt AND (event_type:crash OR parent_process:epub2txt)