1

I am doing a security assessment where a webpage has fields if we sbmit data in them pdf is generated at backend, is it possible to submit some malicious text that will come in pdf and can compromise the user or backend machine.Any input is most welcome.

1

No, this is not possible as far as I know. I cannot think of a vector that would allow that to happen.

However, it is a rule that ALL user input is considered untrusted and must be validated before use. That still applies here. A classic example is allowing unrestricted length inputs (a non-browser client can ignore any HTML "restrictions" on length) to be submitted that causes a buffer overflow on the web server.

So always sanitise and validate any input to the server before you use it.

  • Thanks, so only test should be fuzzing, out of boundary, xss, html – user3754136 Sep 21 '16 at 13:07
  • Yep, usual stuff. – Julian Knight Sep 21 '16 at 15:48
  • If however the PDF Reader or the software that generates the pdf has some unknown exploit it could be possible to use this for malicious purposes. Luckily this is pretty unlikely to happen :) – Lexu Oct 21 '16 at 13:25
  • If the PDF creator is compromised then yes, that would be nasty. If the reader is compromised then the user already has problems of course. These are different to the question though. – Julian Knight Oct 24 '16 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.