CVE-2021-43113

What it actually does

The vulnerability permits command injection by allowing an attacker-controlled filename passed to CompareTool to be unsafely interpolated into the Ghostscript (gs) command line within GhostscriptHelper.java, resulting in arbitrary operating system command execution.

Why it matters to the business

Organizations relying on PDF generation or comparison features in affected libraries face risk of complete system takeover, data exfiltration, or ransomware deployment on servers handling untrusted documents; high ecosystem prevalence in Java-based document workflows amplifies exposure across development and production environments.

How an attack unfolds

An attacker supplies a specially crafted filename containing shell metacharacters to a CompareTool invocation; the filename is directly concatenated into the Ghostscript command line without sanitization, causing the operating system to execute attacker-supplied commands when the comparison operation runs.

How to fix it

Upgrade itext/itext7, itext/itext-java, and itext/itextpdf to commit a2746010d27536b68d60d53f81912d5a7c537b7e or 0231a60e92a1968601d1d7779dc3f57f1274f32f; for Debian roundup packages apply the listed fixed versions (1.2.1-10+etch1 or 1.4.4-4+lenny1) or later; disable Ghostscript integration where feasible until patches are applied.

How to confirm the fix worked

Verify library versions against the fixed commits or package revisions; test CompareTool calls with filenames containing shell metacharacters to confirm they no longer result in command execution; review application dependency manifests for remaining vulnerable iText 7 artifacts.

Typical attack path

1. Locate applications using vulnerable iText 7 CompareTool functionality
2. Craft a malicious filename embedding shell metacharacters and command payloads
3. Trigger PDF comparison processing that invokes GhostscriptHelper
4. Achieve remote code execution on the host system
5. Establish persistence or exfiltrate data

How to detect it

Inspect application and system logs for Ghostscript invocations containing unexpected filenames or shell operators; search process execution records for gs commands with suspicious arguments; correlate with PDF comparison API calls in application traces.

• gs -sDEVICE=
• CompareTool
• GhostscriptHelper
• filename containing ; or | or `

What your security team should do

• Prioritize immediate upgrade of all iText 7 instances given available public exploits and high severity
• Scan source code and dependency trees for usage of CompareTool and GhostscriptHelper
• Implement input sanitization on filenames passed to PDF comparison routines as a temporary control
• Monitor EPSS trend and exploit availability for changes in threat level
• Review logs for suspicious Ghostscript process invocations