Executive brief
jsreport-chrome-pdf is a Node.js library that converts HTML documents to PDF using Chrome. A path traversal vulnerability allows authenticated users to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, private keys, or other confidential data stored on the system.
Technical details
This is a path traversal vulnerability (CWE-22) in jsreport-chrome-pdf prior to version 1.10.0. An authenticated user can exploit insufficient input validation in file path handling to escape intended directory boundaries and access files outside the intended scope. The vulnerability requires valid authentication (PR:L) and network access (AV:N), with no user interaction required. A successful exploit enables an attacker to read arbitrary files on the system (confidentiality impact), but does not allow file modification or denial of service. The fix was applied in version 1.10.0 by blocking file requests, as documented in commit 6750b2f.
Affected products
- jsreport jsreport-chrome-pdf before 1.10.0
Timeline
- 2020-11-05: disclosed: NVD publication date
- 2021-04-13: advisory: GitHub advisory published
- 2020-11-05: patched: Fix released in version 1.10.0