We've joined Protect AIJoin us over there for bounties up to $50,000+ for vulnerabilities in AI/ML repos

Path Traversal in lampnick/doctron

Valid

Reported on

Sep 4th 2021

✍️ Description

doctron is a golang tool that helps conversion of HTML to PDF or image. The input doesn't validate if it's a valid web URL. Trying to access local files using file:/// work. This allows getting a screenshot/PDF of the sensitive files on the system.

🕵️‍♂️ Proof of Concept

A demo version of the tool is hosted at https://doctron.lampnick.com. Visit the website, enter input file:///etc/passwd and click html2pdf basic. You will see the contents of /etc/passwd in the newly generated PDF.

💥 Impact

This vulnerability is capable of reading files on the server it is hosted.

We created a GitHub Issue asking the maintainers to create a SECURITY.md 2 years ago
We have contacted a member of the lampnick/doctron team and are waiting to hear back 2 years ago
lampnick validated this vulnerability 2 years ago
Hack with GitHub has been awarded the disclosure bounty
The fix bounty is now up for grabs
lampnick marked this as fixed with commit fffe90 2 years ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation