Textract OS Command Injection Vulnerability

A command injection vulnerability has been identified in the Node.js text extraction module 'textract', affecting all versions through 2.5.0. The issue arises in multiple extractors, including 'doc', 'rtf', 'dxf', 'images', and a utility file, where the file path parameter is passed directly to 'child_process.exec()' without proper sanitization. This vulnerability allows an attacker to execute arbitrary commands on the host system by manipulating file names or paths.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the host system where 'textract' is used.

Reproduction

To reproduce this vulnerability, upload a file with a malicious name that includes command injection payloads, such as 'test';whoami;'.doc'. When 'textract' processes the file, the injected command will be executed on the system.