@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
The @pdfme/common library, a JavaScript package used for generating PDF documents, is affected by this flaw. An attacker can supply a crafted base PDF URL that slips past the library's safety check, causing the server to fetch internal or cloud metadata resources and expose their contents in the generated documents.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- pdfme common
From 5.5.10 · fixed in 6.2.6