Executive brief
phantom-html-to-pdf is a Node.js library that converts HTML documents to PDF files. A vulnerability allows attackers to bypass local file access restrictions and read arbitrary files from the system, even when file access is explicitly disabled. An attacker could exploit this to extract sensitive configuration files, source code, or other confidential data.
Technical details
The vulnerability is an arbitrary file read (CWE-200, CWE-22) in phantom-html-to-pdf versions before 0.6.2. The flaw allows attackers to bypass the allowLocalFilesAccess flag by injecting JavaScript code that uses window.location to access local file paths (e.g., file:///c:/windows/win.ini). The attack is network-accessible with no authentication required, as the library accepts untrusted HTML input. An attacker can read any file accessible to the process running phantom-html-to-pdf. The vulnerability was patched in version 0.6.2 by implementing proper protocol validation.
Affected products
- phantom-html-to-pdf before 0.6.2
Timeline
- 2020-11-06: disclosed
- 2020-11-06: patched: Fixed in version 0.6.2