Executive brief
Prince is a Node.js library for converting HTML/CSS to PDF documents. Affected versions download executable resources over unencrypted HTTP connections, allowing an attacker with network access to intercept the download and inject malicious code, leading to arbitrary code execution on systems using the library.
Technical details
The vulnerability stems from insecure download of an executable over HTTP without encryption or integrity verification (CWE-311: Missing Encryption of Sensitive Data). An attacker positioned on the network path (e.g., via man-in-the-middle) can intercept the HTTP response and replace the executable with malicious code. The attack requires the attacker to have a privileged network position but no authentication or local access is required. The vulnerability is rooted in improper privilege management during the download process (CWE-269). Patched in version 1.4.7; users on versions ≤1.4.6 are affected.
Affected products
- Node-prince prince <=1.4.6
Timeline
- 2019-02-18: disclosed
- 2019: patched: Version 1.4.7 fixes the vulnerability