CVE-2024-25180
📋 TL;DR
CVE-2024-25180 is a disputed vulnerability in pdfmake 0.2.9 where a crafted POST request to the /pdf endpoint could allow remote code execution. The vulnerability only affects systems where the test framework (outside the main application) is installed and exposed. Organizations using pdfmake with the test framework accessible are at risk.
💻 Affected Systems
- pdfmake
📦 What is this software?
Pdfmake by Pdfmake Project
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the server, executes arbitrary commands, and potentially compromises the entire system.
Likely Case
Limited impact since the vulnerable endpoint is only available when test framework is installed and exposed, which is not typical in production.
If Mitigated
No impact if test framework is not installed or properly restricted to authorized testers only.
🎯 Exploit Status
Exploitation requires sending crafted POST requests to the /pdf endpoint. Public references demonstrate proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: https://github.com/bpampuch/pdfmake/issues/2702
Restart Required: No
Instructions:
No official patch. Remove or restrict access to test framework. Ensure test framework is not installed in production environments.
🔧 Temporary Workarounds
Remove Test Framework
allUninstall or disable the test framework that provides the vulnerable /pdf endpoint.
npm uninstall pdfmake-test-framework
Remove any test framework dependencies from package.json
Restrict Endpoint Access
allConfigure web server to block access to /pdf endpoint or restrict to authorized IPs/users only.
# Example nginx config: location /pdf { deny all; }
# Example Apache: <Location /pdf> Require all denied </Location>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems with test framework
- Deploy web application firewall (WAF) rules to block malicious POST requests to /pdf endpoint
🔍 How to Verify
Check if Vulnerable:
Check if test framework is installed and /pdf endpoint responds to POST requests. Use: curl -X POST http://target/pdfCheck Version:
npm list pdfmakeVerify Fix Applied:
Verify test framework is removed and /pdf endpoint returns 404 or access denied.📡 Detection & Monitoring
Log Indicators:
- POST requests to /pdf endpoint with unusual payloads
- Error logs showing code execution attempts
Network Indicators:
- Unusual outbound connections from pdfmake server
- POST requests to /pdf with base64 or encoded payloads
SIEM Query:
source="web_server" AND uri_path="/pdf" AND http_method="POST"🔗 References
- https://github.com/bpampuch/pdfmake/issues/2702
- https://github.com/joaoviictorti/My-CVES/blob/main/CVE-2024-25180/README.md
- https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-6347243
- https://www.youtube.com/watch?v=QcOlrWUGo6o
- https://github.com/bpampuch/pdfmake/issues/2702
- https://github.com/joaoviictorti/My-CVES/blob/main/CVE-2024-25180/README.md
- https://security.snyk.io/vuln/SNYK-JS-PDFMAKE-6347243
- https://www.youtube.com/watch?v=QcOlrWUGo6o
