PT-2019-14009 · Html Pdf · Html-Pdf
Published
2019-09-20
·
Updated
2022-01-01
·
CVE-2019-15138
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
html-pdf versions 2.2.0 and earlier
html-pdf (all versions)
Description
The issue allows for arbitrary file read via an HTML file that uses XMLHttpRequest to access a file:/// URL. This is due to the package's failure to sanitize HTML input, enabling attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. For example, input with an XHR request such as
request.open("GET","file:///etc/passwd") will result in a PDF document with the contents of /etc/passwd.Recommendations
For version 2.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For all versions, consider restricting the execution of XHR requests in the HTML code to minimize the risk of exploitation. Avoid using the
request.open() function with file:/// URLs in the affected API endpoint until the issue is resolved.Exploit
Exposure of Resource to Wrong Sphere
Information Disclosure
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Html-Pdf