CVE-2020-7763: Arbitrary File Read in phantom-html-to-pdf
Summary
CVE-2020-7763: Arbitrary File Read in phantom-html-to-pdf. Affects phantom-html-to-pdf versions < 0.6.2. Fixed in 0.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The phantom-html-to-pdf package is an npm package that provides functionality to convert HTML files to PDF format using the PhantomJS library. It allows developers to generate PDF documents from HTML templates or web pages. This package is vulnerable to an arbitrary file read vulnerability.
Vulnerability Detail
The vulnerability (CVE-2020-7763) in phantom-html-to-pdf allows an attacker to read arbitrary files on the system. This vulnerability arises due to insufficient input validation when handling user-supplied input. An attacker can exploit this vulnerability by providing a specially crafted input that includes directory traversal sequences to access sensitive files on the system. The impact of this vulnerability can be severe, as it allows unauthorized access to sensitive information, such as configuration files, credentials, or other confidential data.
How To Fix
Minimum fixed version
0.6.2
This is the first release that contains the fix.
npm install phantom-html-to-pdf@0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization measures to prevent directory traversal attacks. This can be done by validating user input and ensuring that file paths are properly sanitized before accessing them. Here is an example of how to sanitize file paths in Node.js:
const path = require('path');
function sanitizeFilePath(filePath) {
const sanitizedPath = path.normalize(filePath);
return sanitizedPath;
}
Conclusion
The phantom-html-to-pdf package is vulnerable to an arbitrary file read vulnerability. It is crucial to upgrade to version 0.6.1 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing input validation and sanitization measures can serve as a temporary workaround. For more information and assistance, please contact DevNack.com.
See every vulnerability recorded for phantom-html-to-pdf →
FAQ
The vulnerability allows an attacker to read arbitrary files on the system, potentially exposing sensitive information.
To fix this vulnerability, upgrade to version 0.6.1 or later of the phantom-html-to-pdf package.
If upgrading is not immediately feasible, implement input validation and sanitization measures to prevent directory traversal attacks.
Yes, the CVSS score for this vulnerability is 7.5 (High).
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
