Executive brief
markdown-pdf is a Node.js library that converts Markdown documents to PDF files. A vulnerability in version 11.0.0 allows attackers to read arbitrary local files by injecting malicious code into Markdown content, which is then executed server-side without proper validation. This could expose sensitive configuration files, credentials, and other confidential data stored on the server.
Technical details
The vulnerability is a server-side cross-site scripting (XSS) flaw (CWE-79) in markdown-pdf 11.0.0 that allows arbitrary local file read. The root cause is insufficient input validation of user-supplied Markdown content before processing. An unauthenticated attacker with network access to a service using markdown-pdf can inject malicious payloads into Markdown input, which are executed server-side during the PDF generation process. By exploiting this XSS, an attacker can read arbitrary files from the server's filesystem. The vulnerability requires no authentication and no special preconditions beyond the ability to submit Markdown content to an affected application. A patch or upgrade is recommended; versions after 11.0.0 should be evaluated for fixes.
Affected products
- markdown-pdf markdown-pdf 11.0.0 and earlier
Timeline
- 2023-04-05: disclosed
- 2023-04-04: advisory: NVD published