GHSA-5P98-WPC9-G498高危已审查

Server-Side Request Forgery in html-pdf-chrome

OSV 1.4.0 · github-reviewed · 修改于 2022-06-23 03:28

发布时间

2020-09-04 23:21

GitHub 审查时间

2020-09-01 02:55

NVD 发布时间

—

源文件

advisories/github-reviewed/2020/09/GHSA-5p98-wpc9-g498/GHSA-5p98-wpc9-g498.json

公告说明

Recommendation

This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.

Original Advisory

All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as <iframe src="http://localhost" height="800px" width="800px"></iframe>. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.

受影响的软件包

npm

html-pdf-chrome

ECOSYSTEM

标识信息

别名 / CVE

无

CWE

CWE-918

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-5p98-wpc9-g498",
  "aliases": [],
  "details": "## Recommendation\nThis package is working as intended. A [Security](https://github.com/westy92/html-pdf-chrome#security) section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.\n\n## Original Advisory\nAll versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src=\"http://localhost\" height=\"800px\" width=\"800px\"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.",
  "summary": "Server-Side Request Forgery in html-pdf-chrome",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.1"
            }
          ]
        }
      ],
      "package": {
        "name": "html-pdf-chrome",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-06-22T19:28:32Z",
  "severity": [],
  "published": "2020-09-04T15:21:32Z",
  "references": [
    {
      "url": "https://github.com/westy92/html-pdf-chrome/issues/249",
      "type": "WEB"
    },
    {
      "url": "https://github.com/westy92/html-pdf-chrome",
      "type": "PACKAGE"
    },
    {
      "url": "https://www.npmjs.com/advisories/1339",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-08-31T18:55:39Z"
  }
}