PT-2020-19775 · Phantom Html To Pdf · Phantom-Html-To-Pdf

Anand Namana · Published 2020-11-05 · Updated 2021-07-21 · CVE-2020-7763

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions phantom-html-to-pdf versions prior to 0.6.1

Description The issue affects the phantom-html-to-pdf package, allowing for potential exploitation. Technical details about exploitation include the use of the conversion function from the "phantom-html-to-pdf" module, where setting allowLocalFilesAccess to false does not prevent access to local files. An example exploit uses the html parameter with a document.write statement to access the c:/windows/win.ini file, demonstrating the vulnerability.

Recommendations For versions prior to 0.6.1, update to version 0.6.1 or later to resolve the issue. As a temporary workaround, consider setting allowLocalFilesAccess to true and implementing additional validation on the html parameter to prevent malicious access to local files. However, updating to a fixed version is the recommended solution.

Exploit

Fix

Information Disclosure

Path traversal

Weakness Enumeration

CWE-200

CWE-22

Related Identifiers

CVE-2020-7763

GHSA-6H7F-QWQM-35PP

SNYK-JS-PHANTOMHTMLTOPDF-1023598

Affected Products

Phantom-Html-To-Pdf

References · 8

• 🔥 https://snyk.io/vuln/SNYK-JS-PHANTOMHTMLTOPDF-1023598 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6h7f-qwqm-35pp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7763 · Security Note
• https://github.com/pofider/phantom-html-to-pdf/commit/b5d2da2639a49a95e0bdb3bc0c987cb6406b8259 · Note
• https://t.me/cibsecurity/15860 · Telegram Post
• https://npmjs.com/package/phantom-html-to-pdf · Note
• https://t.me/cvenotify/5166 · Telegram Post