PT-2020-19757 · Node.Js · Node-Pdf-Generator

Vasilii Ermilov · Published 2020-10-06 · Updated 2021-05-10 · CVE-2020-7740

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions node-pdf-generator versions up to and including 0.0.6

Description The issue arises from a lack of user input validation and sanitization in the content given to node-pdf-generator, allowing an attacker to craft a URL that will be passed to an external server. This enables a Server-Side Request Forgery (SSRF) attack.

Recommendations For versions up to and including 0.0.6, update to a version that includes input validation and sanitization for the content passed to node-pdf-generator. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

CVE-2020-7740

GHSA-HCQ6-H8V2-R5WM

SNYK-JS-NODEPDFGENERATOR-609636

Affected Products

Node-Pdf-Generator

References · 5

• https://osv.dev/vulnerability/CVE-2020-7740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7740 · Security Note
• https://osv.dev/vulnerability/GHSA-hcq6-h8v2-r5wm · Vendor Advisory
• https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29 · Note
• https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636 · Note