CVE-2021-43113: iTextPDF iText RCE Vulnerability

CVE-2021-43113 Overview

CVE-2021-43113 is a command injection vulnerability affecting iTextPDF in iText 7 and versions up to (excluding) 5.5.13.3 and 7.1.17. The flaw exists in the GhostscriptHelper.java class where a CompareTool filename is improperly handled when constructing command line arguments for Ghostscript (gs) execution. This allows attackers to inject arbitrary operating system commands through maliciously crafted filenames.

Critical Impact

This command injection vulnerability allows remote attackers to execute arbitrary system commands on servers processing PDF files with the vulnerable iText library, potentially leading to complete system compromise.

Affected Products

• iTextPDF iText versions prior to 5.5.13.3
• iText 7 versions prior to 7.1.17
• Debian Linux 10.0 and 11.0 (using vulnerable iText packages)

Discovery Timeline

• 2021-12-15 - CVE-2021-43113 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-43113

Vulnerability Analysis

The vulnerability stems from improper input validation in the GhostscriptHelper.java class within the iTextPDF library. When the CompareTool functionality is used to compare PDF documents, filenames are passed to an external Ghostscript process without adequate sanitization. An attacker can craft a malicious filename containing shell metacharacters or command sequences that get interpreted by the operating system shell when Ghostscript is invoked.

The exploitation is network-accessible and requires no prior authentication or user interaction. Successful exploitation grants attackers the ability to execute arbitrary commands with the privileges of the application processing the PDF files, potentially resulting in complete confidentiality, integrity, and availability compromise of the affected system.

Root Cause

The root cause is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The GhostscriptHelper.java class fails to properly sanitize or escape filename parameters before incorporating them into command-line arguments for the Ghostscript executable. This allows shell metacharacters within filenames to break out of the intended command context and execute attacker-controlled commands.

Attack Vector

The attack vector is network-based, targeting applications that use iTextPDF's CompareTool functionality. An attacker can exploit this vulnerability by:

1. Submitting a PDF file with a specially crafted filename to an application using vulnerable iText versions
2. The application invokes the CompareTool functionality, which internally uses GhostscriptHelper.java
3. The malicious filename containing command injection payloads is passed unsanitized to the shell
4. The injected commands execute with the privileges of the application process

The vulnerability is particularly dangerous in web applications and document processing services that accept user-uploaded PDF files and perform comparison operations using iText.

Detection Methods for CVE-2021-43113

Indicators of Compromise

• Unusual process spawning from Java applications, particularly child processes of Ghostscript
• Unexpected network connections or reverse shells originating from PDF processing services
• Anomalous file system activity in directories used for PDF processing
• Log entries showing malformed or suspicious filenames with shell metacharacters in PDF processing workflows

Detection Strategies

• Monitor for command execution patterns associated with Ghostscript that include unexpected parameters or command chaining characters
• Implement application-level logging to capture filenames processed by iText CompareTool functionality
• Deploy runtime application security monitoring to detect command injection attempts
• Use security scanning tools to identify vulnerable iText library versions in your software inventory

Monitoring Recommendations

• Enable detailed logging for all PDF processing operations and review for anomalous filename patterns
• Monitor process trees for unexpected child processes spawned from Java/JVM applications
• Implement file integrity monitoring on systems running vulnerable iText versions
• Set up alerts for network connections initiated by PDF processing components to unexpected destinations

How to Mitigate CVE-2021-43113

Immediate Actions Required

• Upgrade iTextPDF to version 5.5.13.3 or later for iText 5.x installations
• Upgrade iText 7 to version 7.1.17 or later for iText 7.x installations
• Review and update Debian Linux systems according to Debian Security Advisory DSA-5323
• Audit applications to identify all instances where iText CompareTool functionality is used with user-controlled input

Patch Information

iText has released patched versions that address this command injection vulnerability. Organizations should upgrade to the following minimum versions:

• iTextPDF 5.x: Upgrade to version 5.5.13.3 or later. See the GitHub iTextPDF Release 5.5.13.3 for details.
• iText 7.x: Upgrade to version 7.1.17 or later. See the GitHub iText7 Release 7.1.17 for details.

Debian users should apply the security updates referenced in the Debian LTS Security Announcement.

Workarounds

• Disable or restrict access to CompareTool functionality if not required for business operations
• Implement strict input validation on all filenames before passing them to iText library functions
• Run PDF processing services in isolated environments with minimal privileges
• Use application-level sandboxing to limit the impact of potential command execution

# Configuration example
# Verify installed iText version in Maven projects
mvn dependency:tree | grep -i itext

# Check for vulnerable versions in Gradle projects
./gradlew dependencies | grep -i itext

# Update to patched version in pom.xml
# For iText 5.x: <version>5.5.13.3</version>
# For iText 7.x: <version>7.1.17</version>