pdfmake Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in pdfmake versions 0.3.0-beta.2 through 0.3.5. This vulnerability allows remote attackers to access sensitive information by exploiting the src/URLResolver.js component. The issue arises because the URLResolver does not properly enforce access policies for external URLs, potentially leading to unauthorized data retrieval.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive information on the server where pdfmake is used.

Remediation

Users can upgrade to pdfmake version 0.3.6 or later, which includes the `setUrlAccessPolicy()` method for defining custom access rules for external URLs. After updating, server operators should configure an appropriate URL access policy to mitigate the vulnerability.