Description
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pdfme | common | 5.5.10 – < 6.2.6 | 6.2.6 |
References
- GitHub Security Advisory (GHSA-2rg9-wxfw-wrr7) vendor-advisory
- https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6 patch
- GitHub Security Advisory (GHSA-pgx6-7jcq-2qff) related vendor-advisory
- VulnCheck Advisory: @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass third-party-advisory