Deserialization of untrusted data

2022-01-1812:15:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.

CPENameOperatorVersion
html2pdflt5.2.4

CPE	Name	Operator	Version
	html2pdf	lt	5.2.4

References

github.com/spipu/html2pdf

github.com/spipu/html2pdf/blob/master/CHANGELOG.md

www.synacktiv.com/sites/default/files/2022-01/html2pdf_ssrf_deserialization.pdf