CVE-2024-39919: jasonraimondi @jmondi/url-to-png SSRF via localhost screenshot capture

CVE-2024-39919 · Severity: low · CVSS 3.1 · Published 2024-07-15

A vulnerability in the @jmondi/url-to-png utility allows users to capture screenshots of internal web services running on the same server as the application. This could lead to the exposure of sensitive information from private administrative panels or internal tools that are not intended to be accessible from the public internet. Organizations using this tool to generate website previews should update to prevent unauthorized internal network reconnaissance.

Technologies: @jmondi/url-to-png (npm). Vendors: npm.

Quick answers

Is CVE-2024-39919 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-39919 being exploited in the wild.
How severe is CVE-2024-39919?
Low severity, with a CVSS score of 3.1, published 15 July 2024.
Which products and versions are affected?
Jason Raimondi Url-To-Png < 2.1.1; @jmondi/url-to-png (npm) SEMVER:introduced=0,fixed=2.1.2.
Is there a fix for CVE-2024-39919?
Yes. @jmondi/url-to-png (npm): upgrade to 2.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-39919 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-39919?
Check whether you run Jason Raimondi Url-To-Png or @jmondi/url-to-png (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @jmondi/url-to-png (npm): upgrade to 2.1.2 or later
    npm install @jmondi/url-to-png@2.1.2

Technical details

The @jmondi/url-to-png utility, which uses Playwright and headless Chrome to render URLs into images, lacks a default blocklist for local network addresses. An attacker can provide loopback addresses such as 'http://localhost', 'http://127.0.0.1', or 'http://[::]' as the target URL. This results in a Server-Side Request Forgery (SSRF) variant where the service renders and returns screenshots of internal services running on the host machine. The vulnerability is rooted in the application's configuration which, by default, does not prevent the headless browser from accessing the local network. The issue is addressed in version 2.1.1 by implementing a blocklist for local addresses.

Affected products

  • jasonraimondi @jmondi/url-to-png < 2.1.1

Identifiers

  • CVE-2024-39919
  • GHSA-342q-2mc2-5gmp

Timeline

  • 2024-07-13: advisory: Initial advisory published by maintainer
  • 2024-07-15: disclosed: CVE-2024-39919 assigned and published
  • 2024-07-15: patched: Fixed in version 2.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.