Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
A DOS exists in the pdfio parser. crafted pdf files can cause the program to run at 100% utilization and never terminate.
This is different from CVE-2023-24808
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
./pdfiototext pdfiototext-dos2.pdf > test.txt will recreate this vulnerability (i will include a URL for the file download).
The underlying pdfiototext library is vulnerable, not just the pdfiototext executable.
This was discovered by fuzzing, i am unsure exactly what portion of the code is responsible
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
I am unable to attach the pdf which causes this behavior directly to this report. I am providing a download URL and the file hash. If you would like me to submit the pdf in another way, please let me know.
pdfiototext-dos2.pdf
$ curl https://files.catbox.moe/8oy3rr.pdf > pdfiototext-dos2.pdf && shasum -a 256 pdfiototext-dos2.pdf
821710518f8217d3961ebe24d9c40bbb69365a8d1c6ee1ef83ac7facc677aff6 pdfiototexst-dos2.pdf
$ ./pdfiototext pdfiototext-dos2.pdf
Impact
What kind of vulnerability is it? Who is impacted?
Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf.
cyberitech Reporter
Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
A DOS exists in the pdfio parser. crafted pdf files can cause the program to run at 100% utilization and never terminate.
This is different from CVE-2023-24808
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
./pdfiototext pdfiototext-dos2.pdf > test.txt will recreate this vulnerability (i will include a URL for the file download).
The underlying pdfiototext library is vulnerable, not just the pdfiototext executable.
This was discovered by fuzzing, i am unsure exactly what portion of the code is responsible
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
I am unable to attach the pdf which causes this behavior directly to this report. I am providing a download URL and the file hash. If you would like me to submit the pdf in another way, please let me know.
pdfiototext-dos2.pdf
Impact
What kind of vulnerability is it? Who is impacted?
Anyone who uses this library either as a standalone binary or as a library can be DOSed when attempting to parse this type of file. Web servers or other automated processes which rely on this code to turn pdf submissions into plaintext can be DOSed when an attacker uploads the pdf.