Listen to this Post
The vulnerability exists in the node.js-specific builds of the jsPDF library (dist/jspdf.node.js and dist/jspdf.node.min.js). It stems from insufficient sanitization of user-supplied file paths passed to several methods, primarily loadFile, but also including addImage, html, and addFont. When an attacker can control the first argument (the file path) in these methods, they can employ path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files from the server’s local file system. The library does not restrict access to files outside the intended directory. The contents of the accessed file are then directly embedded, unmodified, into the generated PDF document. This allows for information disclosure without requiring direct file system access, as the PDF becomes a carrier for the stolen data. The attack is facilitated because the node.js build has full file system access, unlike browser builds. The example demonstrates that even non-image files like secret.txt can be specified to addImage, and their text content will appear in the output PDF.
Platform: jsPDF node.js
Version: < 4.0.0
Vulnerability: Local file inclusion
Severity: Critical
Date: Not specified
Prediction: Patched 4.0.0
What Undercode Say:
Analytics
Code example from
import { jsPDF } from “./dist/jspdf.node.js”;
const doc = new jsPDF();
doc.addImage(“./secret.txt”, “JPEG”, 0, 0, 10, 10);
doc.save(“test.pdf”);
Bash command to update:
npm install [email protected]
Exploit
Control path argument.
Use traversal sequences.
Read arbitrary files.
Protection from this CVE
Update to [email protected].
Use node –permission flag.
Sanitize user input paths.
Impact
Information disclosure.
Local file read.
PDF data exfiltration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
