CVE-2022-24859

PyPDF2 <= 1.27.5 PDF Infinite Loop Vulnerability

• CVSS 5.5
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• Input Validation and Sanitization
• Remote

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 if the code attempts to get the content stream. The reason is that the last while-loop in `ContentStream._readInlineImage` only terminates when it finds the `EI` token, but never actually checks if the stream has already ended. This issue has been resolved in version `1.27.5`. Users unable to upgrade should validate and PDFs prior to iterating over their content stream.

CVE

CVE-2022-24859

CWE

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

CVSS base score

5.5

Published

2022-04-18

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to PyPDF2 version 1.27.5 or higher.

import PyPDF2

def read_pdf(file_path):
    # VULNERABLE: This code is susceptible to path traversal
    with open(file_path, "rb") as file:
        reader = PyPDF2.PdfReader(file)
        for page in reader.pages:
            content_stream = page.get_contents()
            for obj in content_stream:
                if obj == b'EI':
                    break
                print(obj)

read_pdf("example.pdf")

import PyPDF2

def read_pdf(file_path):
    # SECURE: This version prevents path traversal
    with open(file_path, "rb") as file:
        reader = PyPDF2.PdfReader(file)
        for page in reader.pages:
            try:
                content = page.extract_text()
                print(content)
            except Exception as e:
                print(f"Error reading page: {e}")

read_pdf("example.pdf")

@misc{vaitp:cve202224859,
  title        = {{PyPDF2 <= 1.27.5 PDF Infinite Loop Vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-24859},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-24859/}}
}