CVE-2022-36231: 
Ruby vulnerability analysis and mitigation

The pdf_info Ruby gem version 0.5.3 and earlier contains a Command Execution vulnerability (CVE-2022-36231). The vulnerability exists because the Ruby code uses backticks instead of Open3 for command execution, allowing attackers to inject and execute arbitrary system commands (GitHub CVE, MITRE CVE).

The vulnerability stems from improper validation in the PDF::Info object initialization and metadata processing. When creating a new PDF::Info object, no validation is performed on the user-provided path. The command method uses backticks for system command execution without sanitizing the @pdf_path variable, allowing command chaining through semicolons to execute arbitrary commands (GitHub CVE).

An attacker can exploit this vulnerability to execute arbitrary operating system commands in the context of the application running the pdf_info gem. This could lead to complete system compromise depending on the application's privileges (GitHub CVE).

The vulnerability is easily exploitable by providing a specially crafted payload that includes command chaining (using semicolons) when creating a PDF::Info object. For example, an attacker can inject a reverse shell command that would execute when the metadata method is called (GitHub CVE).

The vulnerability has been fixed by replacing the backtick command execution with Open3, which provides safer command execution functionality. Users should upgrade to a patched version of the gem. A pull request implementing this fix was merged into the main repository (GitHub PR).