ERPNext and Frappe Framework Server-Side Request Forgery Vulnerability in PDF Generation

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Print Format feature of ERPNext version 16.0.1 and Frappe Framework version 16.1.1. This vulnerability arises because user-supplied HTML is not adequately sanitized before being converted into PDF. The PDF rendering engine, which uses wkhtmltopdf, processes the HTML and fetches external resources referenced by elements like iframes. This behavior can be exploited to make arbitrary HTTP requests to internal services, including cloud metadata endpoints, potentially leading to the disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows attackers to perform SSRF attacks against internal services, access cloud metadata endpoints (such as those on AWS or GCP), enumerate internal networks, and potentially retrieve sensitive information.