Vulnerability vector:
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Severity (CVSSv4.0): 6.9 (Medium)
Description:
The vulnerability was identified in OpenPDF, version 2.0.4.
The discovered vulnerability allows an attacker to read arbitrary files on the server by inserting absolute paths or directory traversal sequences in the HTML‑tag attributes processed by OpenPDF. This enables the disclosure of confidential data, and if the attacker already has system access, they can also map the file system structure and gather information about the runtime environment.
Vulnerability status: Confirmed during research
Date of vulnerability discovery: 23.04.2025
Recommendations:
Mitigation measures for exploiting the vulnerability
1. HTML sanitisation
Remove scripts and frames: Use well‑maintained sanitisation libraries (e.g., Bleach for Python, HTML Purifier for PHP, or DOMPurify for JavaScript).
Whitelist tags: Allow only basic “safe” tags (e.g., `<b>`, `<i>`, `<p>`).
Clean URLs: Strip attributes that could point to local files or internal resources.
2. Prepared template
When generating a PDF, start from a pre‑built template. Pay special attention to any data supplied by the user – it must undergo strict sanitisation before being injected into the template.
3. Library configuration
Review the library’s documentation for security‑related flags, even if they are disabled by default (common mis‑configuration tips): disable access to local files; disable JavaScript execution; disable loading of external resources.
4. Isolation (sandboxing): If the library cannot be securely configured, run the rendering process in an isolated environment: containerisation; network isolation; filesystem permission restrictions.
5. Architectural controls: Egress filtering – block outbound requests from the rendering service to prevent SSRF. Client‑side generation – where feasible, move PDF creation to the user’s browser using libraries such as jsPDF. This eliminates SSRF and remote‑code‑execution risks on your server.
General rule: Do not trust the library to provide protection on its own. Treat incoming HTML as malicious code, run the generation process in a “sterile” isolated environment, and strip all dangerous elements from the HTML beforehand.
Researcher: Nikita Sveshnikov (Positive Technologies)