Executive brief
node-pdf-generator is a Node.js library that generates PDF documents from HTML content. A server-side request forgery (SSRF) vulnerability allows attackers to craft malicious URLs that are passed to external servers without proper validation, potentially enabling access to internal systems or sensitive information.
Technical details
The vulnerability is a server-side request forgery (SSRF, CWE-918) caused by insufficient input validation and sanitization in node-pdf-generator. Attackers can craft URLs in the content passed to the library that will be fetched by the server without restriction, potentially allowing them to access internal services, cloud metadata endpoints, or other sensitive resources. The vulnerability affects all versions through 0.0.6 and requires only network access to an application using the library—no authentication or user interaction is needed. No patch information is available in the advisory.
Affected products
- node-pdf-generator node-pdf-generator 0.0.6 and earlier
Timeline
- 2020-10-06: disclosed
- 2021-05-10: advisory