Skip to content

Denial Of Service when opening a corrupt PDF file

Moderate
michaelrsweet published GHSA-cjc4-x96x-fvgf Feb 6, 2023

Package

pdfio (Generic)

Affected versions

<= 1.01

Patched versions

None

Description

Summary

Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
A DOS exists in the pdfio parser. crafted pdf files can cause the program to run at 100% utilization and never terminate. in practice, I verified with a 30 minute timeout time. the pdf which causes this crash is about 28kb in size and was discovered via fuzzing.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
./pdfiototext pdfiototext-dos.pdf > test.txt will recreate this vulnerability (i will include a URL for the file download).
The underlying pdfiototext library is vulnerable, not just the pdfiototext executable.
This was discovered by fuzzing, i am unsure exactly what portion of the code is responsible.

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.
I am unable to attach the pdf which causes this behavior directly to this report. I am providing a download URL and the file hash. If you would like me to submit the pdf in another way, please let me know.
pdfiototext-dos.pdf

shasum -a 256 pdfiototext-crash.pdf 
e1abe17f703941295c171458fc593f7c1dc05b221c91b92684854f9989e03c2d  pdfiototext-crash.pdf

Impact

What kind of vulnerability is it? Who is impacted?
Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf.

Severity

Moderate
4.0
/ 10

CVSS base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE ID

CVE-2023-24808

Weaknesses

No CWEs

Credits