by Kastro
Paper/Archive/CVE-2024-25180

CVE-2024-25180

pdfmake_project pdfmake — An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint.

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.6.636 × 2012.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
pdfmake0.2.9–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/joaoviictorti/My-CVES/blob/main/CVE-2024-25180/README.mdrefyoutube.com/watch?v=QcOlrWUGo6orefsecurity.snyk.io/vuln/SNYK-JS-PDFMAKE-6347243refgithub.com/bpampuch/pdfmake/issues/2702