Vulnerability vector:
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- Severity (CVSSv4.0): 7.7 (High)
Description:
The vulnerability was identified in OpenPDF, versions 2.0.3.
The discovered vulnerability allows an attacker craft arbitrary HTTP requests that the vulnerable server will send to both external services and internal network endpoints. By exploiting this, the attacker can exfiltrate sensitive data from protected resources, perform internal network reconnaissance (e.g., port and service scanning), and potentially trigger denial‑of‑service conditions. The server can also be abused as a proxy to hide the attacker’s true origin.
Vulnerability status: Confirmed during research
Date of vulnerability discovery: 23.04.2025
Recommendations:
Mitigation measures for exploiting the vulnerability
1. HTML sanitisation
Remove scripts and frames: Use well‑maintained sanitisation libraries (e.g., Bleach for Python, HTML Purifier for PHP, or DOMPurify for JavaScript).
Whitelist tags: Allow only basic “safe” tags (e.g., `<b>`, `<i>`, `<p>`).
Clean URLs: Strip attributes that could point to local files or internal resources.
2. Prepared template
When generating a PDF, start from a pre‑built template. Pay special attention to any data supplied by the user – it must undergo strict sanitisation before being injected into the template.
3. Library configuration
Review the library’s documentation for security‑related flags, even if they are disabled by default (common mis‑configuration tips): disable access to local files; disable JavaScript execution; disable loading of external resources.
4. Isolation (sandboxing): If the library cannot be securely configured, run the rendering process in an isolated environment: containerisation; network isolation; filesystem permission restrictions.
5. Architectural controls: Egress filtering – block outbound requests from the rendering service to prevent SSRF. Client‑side generation – where feasible, move PDF creation to the user’s browser using libraries such as jsPDF. This eliminates SSRF and remote‑code‑execution risks on your server.
General rule: Do not trust the library to provide protection on its own. Treat incoming HTML as malicious code, run the generation process in a “sterile” isolated environment, and strip all dangerous elements from the HTML beforehand.
Researcher: Aleksey Solovev (Positive Technologies)