Junglewise Threat Intelligence

CVE-2024-1647: Pyhtml2pdf local file read via improper HTML validation

CVE-2024-1647 · Severity: high · CVSS 7.5 · Published 2024-02-20

Vendors: PyPI.

Executive brief

Pyhtml2pdf is a Python library used to convert HTML content into PDF documents. A security vulnerability in version 0.0.6 and earlier allows an attacker to read sensitive files from the local server by providing specially crafted HTML. This could lead to the exposure of private system data or configuration files.

Technical details

Pyhtml2pdf version 0.0.6 is vulnerable to a Cross-Site Scripting (XSS) / Server-Side Request Forgery (SSRF) style attack that facilitates local file inclusion. The root cause is the lack of input validation for HTML content processed by the library. An unauthenticated remote attacker can submit malicious HTML tags (such as <iframe> or <script>) that, when rendered during the PDF conversion process, allow the attacker to read arbitrary files from the local file system. This vulnerability is tracked as CVE-2024-1647 and currently has no known patched version.

Affected products

  • kumaf pyhtml2pdf <= 0.0.6

Timeline

  • 2024-02-20: disclosed
  • 2024-02-20: advisory

References