Threat Investigation
Request a demo

CVE-2024-25180

Critical

Description

An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. NOTE: this is disputed because the behavior of the /pdf endpoint is intentional. The /pdf endpoint is only available after installing a test framework (that lives outside of the pdfmake applicaton). Anyone installing this is responsible for ensuring that it is only available to authorized testers.

SeverityCritical
CVSS9.8
Exploit probability—
ProductPdfmake
PublishedFeb 29, 2024
First seenFeb 29, 2024
Weakness typeCWE-94Code injection

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

ProductAffected versionsFixed in
pdfmake_project pdfmake0.2.9—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.