CVE-2013-1933 Karteek Docsplit vulnerable to OS Command Injection
HighCVSS 9.3
EPSS 1.8%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems karteek-docsplit(RubyGems) | <= 0.5.4 | No fix listed |
| documentcloud karteek-docsplit | = 0.5.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- karteekdocsplit-cve20131933-command-exec(83277) vdb-entry
- vapid.dhs.org
- [oss-security] 20130408 Re: Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4 mailing-list
- github.com exploit
- github.com
- 92117 vdb-entry