CyberRota Analysis
AI-GeneratedThe vulnerability exists in the @pdfme/common library prior to version 5.5.10, specifically in the getB64BasePdf function, which allows for server-side request forgery due to inadequate validation of the basePdf input. This flaw can be exploited by attackers to manipulate servers or clients into making unauthorized requests to internal endpoints, potentially leading to metadata exfiltration and network reconnaissance. Organizations using this library should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to internal endpoints, enabling metadata exfiltration, network reconnaissance, and blind request forgery attacks.