Executive brief
html-pdf is a Node.js library that converts HTML documents to PDF files. The vulnerability allows attackers to read arbitrary files from the server by injecting malicious HTML code containing XMLHttpRequest (XHR) commands. An attacker could exfiltrate sensitive files like /etc/passwd, exposing confidential server data and potentially leading to system compromise.
Technical details
The vulnerability is an arbitrary file read caused by insufficient input sanitization in html-pdf. The library executes XHR requests embedded in HTML code server-side without validation, allowing attackers to use file:// URLs to access local files. An attacker supplies malicious HTML with payloads like request.open("GET","file:///etc/passwd"), which the server executes during PDF generation, returning file contents in the PDF output. The vulnerability affects all versions prior to 3.0.1, where a fix was released. Network reachability and ability to control HTML input are required for exploitation.
Affected products
- html-pdf html-pdf before 3.0.1
Timeline
- 2019-09-20: disclosed
- 2019-10-11: advisory
- 2019: patched: Fixed in version 3.0.1