Executive brief
html-pdf-chrome is a Node.js library that converts HTML documents to PDF files using Chrome/Chromium. The library fails to restrict HTTP requests made during PDF generation, allowing attackers to embed malicious links in HTML input that cause the server to fetch internal resources, including private resources in the hosting environment. This could lead to unauthorized access to sensitive data or internal services.
Technical details
html-pdf-chrome is vulnerable to SSRF via improper handling of external resource references in parsed HTML. When HTML containing external resource references (e.g., <iframe src="http://localhost">) is processed, the library automatically executes HTTP requests to fetch those resources. The vulnerability requires attacker-controlled HTML input to the library, which is a common use case when the library is exposed to user-supplied content. An attacker can craft HTML with references to internal services (localhost, internal IPs, cloud metadata endpoints) to access private resources or retrieve sensitive data accessible to the server. The library added a Security section and mitigation guidance in version 0.6.1 to document proper usage patterns; npm later revoked the advisory, suggesting the issue is treated as a usage/configuration concern rather than a code defect.
Affected products
- westy92 html-pdf-chrome < 0.6.1
Timeline
- 2019-11-20: disclosed: Issue #249 opened on GitHub
- 2020-09-04: advisory: GHSA-5p98-wpc9-g498 published
- 2020-09-04: patched: Security section added in v0.6.1; npm revoked advisory