Executive brief
A vulnerability in the @jmondi/url-to-png utility allows users to capture screenshots of internal web services running on the same server as the application. This could lead to the exposure of sensitive information from private administrative panels or internal tools that are not intended to be accessible from the public internet. Organizations using this tool to generate website previews should update to prevent unauthorized internal network reconnaissance.
Technical details
The @jmondi/url-to-png utility, which uses Playwright and headless Chrome to render URLs into images, lacks a default blocklist for local network addresses. An attacker can provide loopback addresses such as 'http://localhost', 'http://127.0.0.1', or 'http://[::]' as the target URL. This results in a Server-Side Request Forgery (SSRF) variant where the service renders and returns screenshots of internal services running on the host machine. The vulnerability is rooted in the application's configuration which, by default, does not prevent the headless browser from accessing the local network. The issue is addressed in version 2.1.1 by implementing a blocklist for local addresses.
Affected products
- jasonraimondi @jmondi/url-to-png < 2.1.1
Timeline
- 2024-07-13: advisory: Initial advisory published by maintainer
- 2024-07-15: disclosed: CVE-2024-39919 assigned and published
- 2024-07-15: patched: Fixed in version 2.1.1