Executive brief
Zmarkdown's remark-download-images plugin is used to process Markdown documents and automatically download embedded images. A Server-Side Request Forgery vulnerability allows attackers to craft Markdown that forces the server to make HTTP requests to internal private IP addresses (such as 192.168.x.x), potentially exposing private image files and other resources on the local network that were never intended for public access.
Technical details
The vulnerability is a blind SSRF (CWE-918) in the remark-download-images module caused by insufficient filtering of URLs when downloading images referenced in Markdown. An attacker can embed image URLs pointing to internal IP ranges in Markdown input; the plugin downloads these URLs server-side without validating that they are not on private IP ranges (IPv4 or IPv6). This allows an unauthenticated attacker with the ability to submit Markdown content to access private services and documents on the internal network. The vulnerability was patched in version 3.1.0 by adding strict filtering to prevent image downloads from local IP ranges and resolved hostnames that map to private IPs.
Affected products
- Zmarkdown remark-download-images < 3.1.0
Timeline
- 2024-02-03: disclosed: GHSA advisory published
- 2024-02-03: patched: Fix released in version 3.1.0