CVE-2024-1647
📋 TL;DR
Pyhtml2pdf version 0.0.6 contains a cross-site scripting (XSS) vulnerability that allows remote attackers to read arbitrary local files. Attackers can inject malicious HTML content that gets processed by the application, leading to file disclosure. This affects any system running the vulnerable pyhtml2pdf package.
💻 Affected Systems
- pyhtml2pdf
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive local files including configuration files, credentials, and user data through file read operations.
Likely Case
Exfiltration of sensitive files from the server where pyhtml2pdf is running, potentially leading to credential theft or data breach.
If Mitigated
Limited impact with proper input validation and file access restrictions in place.
🎯 Exploit Status
Exploitation requires the attacker to provide malicious HTML content to the application, which is then processed without validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check if pyhtml2pdf is installed: pip show pyhtml2pdf
2. If version is 0.0.6, uninstall it: pip uninstall pyhtml2pdf
3. Consider alternative PDF generation libraries with proper security controls
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject or sanitize HTML content containing file access attempts
File Access Restrictions
linuxRun pyhtml2pdf in a sandboxed environment with restricted file system access
docker run --read-only -v /safe/path:/app pyhtml2pdf
🧯 If You Can't Patch
- Isolate the vulnerable system from sensitive data and network segments
- Implement strict network filtering to limit access to the vulnerable service
🔍 How to Verify
Check if Vulnerable:
Run: pip show pyhtml2pdf | grep Version
If output shows 'Version: 0.0.6', the system is vulnerable.Check Version:
pip show pyhtml2pdf | grep VersionVerify Fix Applied:
After uninstalling, verify with: pip list | grep pyhtml2pdf
Should show no results or a different version.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from pyhtml2pdf process
- HTML input containing file:// or local file references
Network Indicators:
- Outbound connections from pyhtml2pdf server to unexpected destinations
- Large data transfers following HTML processing
SIEM Query:
source="application.log" AND process="pyhtml2pdf" AND (file_access OR file_read)