Описание
@jmondi/url-to-png contains a Path Traversal vulnerability
Summary
When trying to add a BLOCK_LIST feature when the maintainer noticed they didn't sanitize the ImageId in the code, which leads to path traversal vulnerability. Now, this is different from a traditional path traversal issue, because as of NOW you can store the image in any place arbitrarily, and given enough time they might be able to come up with a working exploit BUT for the time being they am reporting this.
Details
@jmondi/url-to-png does not sanitizing the ImageID as in not removing special chars from the params (extract_query_params.ts#l75)
This when fed to other parts of the code such as (filesystem.ts#L34)
Would result in path traversal issue.
PoC
Set this in your .env file and use this as your payload.
This will create a .png file in the /tmp section of the system.
Loom POC: https://www.loom.com/share/bd7b306cdae7445c97e68f0626e743a6
This is valid for pretty much all the arguments (except for numeric values)
A simple fix would be to use the slugify for the params as well like so (#L75)
Impact
This would be path traversal vulnerability which allows arbitrary write as of now.
Ссылки
- https://github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr
- https://nvd.nist.gov/vuln/detail/CVE-2024-39918
- https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507
- https://github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts#L75
- https://github.com/jasonraimondi/url-to-png/releases/tag/v2.1.2
Пакеты
@jmondi/url-to-png
< 2.1.2
2.1.2
Связанные уязвимости
@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This allows an attacker to store an image in an arbitrary location that the server has permission to access. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.