PT-2024-28732 · Npm · @Jmondi/Url-To-Png

Realarcherl · Published 2024-07-15 · Updated 2024-07-16 · CVE-2024-39919

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @jmondi/url-to-png versions prior to 2.1.1

Description The issue concerns the ALLOW LIST in the @jmondi/url-to-png package, which permits capturing screenshots of web services running on localhost, 127.0.0.1, or the [::] by default. If hosted on a server, users could capture screenshots of other web services running locally, potentially disclosing internal web services. This has been addressed with the addition of a blocklist in version 2.1.1.

Recommendations For versions prior to 2.1.1, upgrade to version 2.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the ALLOW LIST to minimize the risk of exploitation. Avoid using the package to capture screenshots of internal web services until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-39919

GHSA-342Q-2MC2-5GMP

Affected Products

@Jmondi/Url-To-Png

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39919.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39919 · Security Note
• https://osv.dev/vulnerability/GHSA-342q-2mc2-5gmp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39919 · Vendor Advisory
• https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-342q-2mc2-5gmp · Note
• https://github.com/jasonraimondi/url-to-png · Note
• https://github.com/jasonraimondi/url-to-png/commit/f62ff40403ffa1781459d6be8d97b8035888c00c · Note
• https://t.me/cvedetector/904 · Telegram Post