CVE-2023-0835: markdown-pdf - Local File Read via Server Side XSS
Summary
CVE-2023-0835: markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS). Affects markdown-pdf versions < 11.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
markdown-pdf is an npm package that allows users to convert Markdown files to PDF format. It provides a convenient way to generate PDF documents from Markdown content. However, version 11.0.0 of markdown-pdf is vulnerable to a local file read attack through server-side cross-site scripting (XSS). This vulnerability arises due to the lack of input validation on user-entered Markdown content.
Vulnerability Detail
The vulnerability in markdown-pdf version 11.0.0 enables an external attacker to remotely access arbitrary local files. By exploiting the server-side XSS vulnerability, an attacker can inject malicious Markdown content that triggers the file read operation. This can lead to unauthorized access to sensitive files on the server, potentially exposing confidential information or facilitating further attacks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the user-entered Markdown content to prevent any malicious scripts or file read operations. Implement a content validation mechanism that checks for potentially harmful input and rejects or sanitizes it before processing. Here's an example using the 'markdown-pdf' package in Node.js:
const markdownPdf = require('markdown-pdf');
const sanitizeHtml = require('sanitize-html');
const markdownContent = '...'; // User-entered Markdown content
const sanitizedContent = sanitizeHtml(markdownContent);
markdownPdf().from.string(sanitizedContent).to('output.pdf', () => {
console.log('PDF generated successfully.');
});
In this example, the 'sanitize-html' package is used to sanitize the Markdown content before passing it to the 'markdown-pdf' package for conversion.
Conclusion
markdown-pdf version 11.0.0 is vulnerable to a local file read attack through server-side XSS. It is crucial to upgrade to a patched version (e.g., 11.0.1) or any higher version that addresses this vulnerability. Implementing input validation and content sanitization can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for markdown-pdf →
FAQ
markdown-pdf is an npm package that converts Markdown files to PDF format. It simplifies the process of generating PDF documents from Markdown content.
The vulnerability arises due to the lack of input validation on user-entered Markdown content. This allows an attacker to inject malicious content that triggers a server-side XSS attack, leading to unauthorized file read operations.
The vulnerability can result in unauthorized access to sensitive files on the server. This can lead to exposure of confidential information or facilitate further attacks on the system.
To fix this vulnerability, update the 'markdown-pdf' package to a version that is not affected by this issue. The maintainers have released patched versions (e.g., 11.0.1) that address this vulnerability.
As a temporary workaround, you can sanitize the user-entered Markdown content to prevent any malicious scripts or file read operations. Implement a content validation mechanism that checks for potentially harmful input and rejects or sanitizes it before processing.
Related vulnerabilities
Recent vulnerabilities recorded for markdown-pdf.
