Key points
- The flaw allows OS command execution through the generatePdf or generateHtml functions.
- Vulnerability exists in office-converter versions up to and including 1.0.2.
- The issue stems from unsafe concatenation of user input into a shell command.
Security researchers identified a critical OS command injection vulnerability in the office-converter npm package, allowing attackers to execute arbitrary commands on affected systems. According to the National Vulnerability Database, this flaw enables attackers to run commands with the privileges of the Node.js process by supplying crafted filenames to specific conversion functions.
The vulnerability affects versions of office-converter up to 1.0.2, maintained by vworld4u. Attackers can exploit this weakness by embedding shell metacharacters, such as backticks or closing quotes, within the filename argument passed to generatePdf() or generateHtml(). This input is then concatenated into a unoconv command executed via child_process.exec(), resulting in command execution on the host.
Context and Background
The National Vulnerability Database assigns CVE-2020-37282 a CVSS score of 9.3, classifying it as critical. The weakness is categorised under CWE-78, which relates to OS command injection. The source material describes the flaw as allowing attackers to execute commands by supplying a crafted fileName to the specified functions.
Who Is Affected
Any organisation using the office-converter npm package in versions 1.0.2 or earlier is potentially exposed. The flaw is present in the core conversion logic, meaning any application relying on this library for file format conversion via the exposed functions inherits the risk. The source material does not confirm whether a fix or patch exists for this vulnerability.
What happens next
Teams should audit their dependencies to determine if office-converter is included in their software supply chain. If present, they must verify the version is strictly greater than 1.0.2. Until a fix is confirmed, organisations should consider isolating services that use this library or restricting network access to reduce the impact of potential exploitation.
Why this attack works
Command injection occurs when an application passes unsanitised user input directly to a system shell. In this scenario, the library treats the filename as trusted data, failing to escape special characters that the operating system interprets as instructions. This bypasses application-level logic, allowing an intruder to chain arbitrary commands. Teams usually monitor for unexpected process spawning or unusual network connections from conversion services, as these indicators often signal successful exploitation of such flaws.
What to do and how to stay safe: office-converter
- Audit your npm dependencies to identify any instances of the office-converter package.
- Verify the installed version is higher than 1.0.2 to ensure you are not affected.
- Monitor system logs for unexpected command executions or new processes spawned by Node.js.
- Restrict network access for services running vulnerable versions until an update is available.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is tracked as CVE-2020-37282.
Which functions are vulnerable to this attack?
The generatePdf() and generateHtml() functions are vulnerable to OS command injection.
What is the severity rating of this flaw?
The NVD rates this vulnerability as critical with a CVSS score of 9.3.
