Critical · published April 26, 2021
🚨 An attacker can snag any file from your server with just a crafty PDF export! This vulnerability plagues all HedgeDoc instances with PDF export enabled. 🔥 Imagine a restaurant where the chef accidentally serves customers the secret recipe files along with their meals — that's what's happening here when notes are exported as PDFs! The attacker's ability to modify a note lets them slip in code just like a sneaky ingredient in a dish. This vulnerability is absolutely devastating! An attacker could easily read sensitive files like the `config.json`, which often contains database credentials or OAuth secrets. If exploited, it could lead to significant data breaches for any organization using HedgeDoc.
Imagine a restaurant where the chef accidentally serves customers the secret recipe files along with their meals — that's what's happening here when notes are exported as PDFs! The attacker's ability to modify a note lets them slip in code just like a sneaky ingredient in a dish. This flaw allows an attacker to use code injection within a note's content to access arbitrary files on the server when exporting to PDF, leveraging PhantomJS's internal file handling for rendering.
This vulnerability is absolutely devastating! An attacker could easily read sensitive files like the `config.json`, which often contains database credentials or OAuth secrets. If exploited, it could lead to significant data breaches for any organization using HedgeDoc. Immediately upgrade to HedgeDoc version 1.5.0 or later to patch this exploit. If an upgrade isn’t feasible right away, mitigate the risk by disabling PDF export using `CMD_ALLOW_PDF_EXPORT=false` or by setting `"allowPDFExport": false` in `config.json`. You've got this! By following these steps, you can shore up your defenses and protect your vital data! 🛡️