CVE-2021-43113: iTextPDF iText RCE Vulnerability

CVE-2021-43113 Overview

CVE-2021-43113 is a command injection vulnerability affecting iTextPDF in iText 7 and versions up to (excluding) 5.5.13.3 and 7.1.17. The flaw exists in the GhostscriptHelper.java class where a CompareTool filename is improperly handled when constructing command line arguments for Ghostscript (gs) execution. This allows attackers to inject arbitrary operating system commands through maliciously crafted filenames.

Critical Impact
This command injection vulnerability allows remote attackers to execute arbitrary system commands on servers processing PDF files with the vulnerable iText library, potentially leading to complete system compromise.

Affected Products

iTextPDF iText versions prior to 5.5.13.3
iText 7 versions prior to 7.1.17
Debian Linux 10.0 and 11.0 (using vulnerable iText packages)

Discovery Timeline

2021-12-15 - CVE-2021-43113 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43113

Vulnerability Analysis

The vulnerability stems from improper input validation in the GhostscriptHelper.java class within the iTextPDF library. When the CompareTool functionality is used to compare PDF documents, filenames are passed to an external Ghostscript process without adequate sanitization. An attacker can craft a malicious filename containing shell metacharacters or command sequences that get interpreted by the operating system shell when Ghostscript is invoked.

The exploitation is network-accessible and requires no prior authentication or user interaction. Successful exploitation grants attackers the ability to execute arbitrary commands with the privileges of the application processing the PDF files, potentially resulting in complete confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The GhostscriptHelper.java class fails to properly sanitize or escape filename parameters before incorporating them into command-line arguments for the Ghostscript executable. This allows shell metacharacters within filenames to break out of the intended command context and execute attacker-controlled commands.

Attack Vector

The attack vector is network-based, targeting applications that use iTextPDF's CompareTool functionality. An attacker can exploit this vulnerability by:

Submitting a PDF file with a specially crafted filename to an application using vulnerable iText versions
The application invokes the CompareTool functionality, which internally uses GhostscriptHelper.java
The malicious filename containing command injection payloads is passed unsanitized to the shell
The injected commands execute with the privileges of the application process

The vulnerability is particularly dangerous in web applications and document processing services that accept user-uploaded PDF files and perform comparison operations using iText.

Detection Methods for CVE-2021-43113

Indicators of Compromise

Unusual process spawning from Java applications, particularly child processes of Ghostscript
Unexpected network connections or reverse shells originating from PDF processing services
Anomalous file system activity in directories used for PDF processing
Log entries showing malformed or suspicious filenames with shell metacharacters in PDF processing workflows

Detection Strategies

Monitor for command execution patterns associated with Ghostscript that include unexpected parameters or command chaining characters
Implement application-level logging to capture filenames processed by iText CompareTool functionality
Deploy runtime application security monitoring to detect command injection attempts
Use security scanning tools to identify vulnerable iText library versions in your software inventory

Monitoring Recommendations

Enable detailed logging for all PDF processing operations and review for anomalous filename patterns
Monitor process trees for unexpected child processes spawned from Java/JVM applications
Implement file integrity monitoring on systems running vulnerable iText versions
Set up alerts for network connections initiated by PDF processing components to unexpected destinations

How to Mitigate CVE-2021-43113

Immediate Actions Required

Upgrade iTextPDF to version 5.5.13.3 or later for iText 5.x installations
Upgrade iText 7 to version 7.1.17 or later for iText 7.x installations
Review and update Debian Linux systems according to Debian Security Advisory DSA-5323
Audit applications to identify all instances where iText CompareTool functionality is used with user-controlled input

Patch Information

iText has released patched versions that address this command injection vulnerability. Organizations should upgrade to the following minimum versions:

iTextPDF 5.x: Upgrade to version 5.5.13.3 or later. See the GitHub iTextPDF Release 5.5.13.3 for details.
iText 7.x: Upgrade to version 7.1.17 or later. See the GitHub iText7 Release 7.1.17 for details.

Debian users should apply the security updates referenced in the Debian LTS Security Announcement.

Workarounds

Disable or restrict access to CompareTool functionality if not required for business operations
Implement strict input validation on all filenames before passing them to iText library functions
Run PDF processing services in isolated environments with minimal privileges
Use application-level sandboxing to limit the impact of potential command execution

bash

# Configuration example
# Verify installed iText version in Maven projects
mvn dependency:tree | grep -i itext

# Check for vulnerable versions in Gradle projects
./gradlew dependencies | grep -i itext

# Update to patched version in pom.xml
# For iText 5.x: <version>5.5.13.3</version>
# For iText 7.x: <version>7.1.17</version>