Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the CMapDB._load_data function in babeldoc/pdfminer/cmapdb.py. This function is responsible for loading CMap files, which are used for character mapping in PDFs. The vulnerability arises because the function does not properly sanitize the CMap name, which can be controlled by a crafted PDF file, before using it to construct a file path. It only removes NUL bytes, but allows path traversal characters like / and ... An attacker can embed a hex-encoded absolute path in a PDF's /Encoding name. When BabelDOC processes this PDF, the hex-encoded path is decoded and passed to CMapDB._load_data. The use of os.path.join with an absolute path discards the intended base directory, allowing the attacker to specify an arbitrary path on the filesystem. The function then proceeds to open the file at this path and deserialize it using pickle, which results in arbitrary code execution with the privileges of the process running BabelDOC. The fix involves completely replacing the insecure CMap loading mechanism with a new one that uses a manifest of known-good CMaps, verifies their paths, sizes, and SHA-256 hashes before deserialization, thus preventing any malicious pickle files from being loaded.
CMapDB._load_datababeldoc/pdfminer/cmapdb.py
CMapDB.get_cmapbabeldoc/pdfminer/cmapdb.py
CMapDB.get_unicode_mapbabeldoc/pdfminer/cmapdb.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| BabelDOC | pip | <= 0.6.2 | 0.6.3 |