$stylesheet = $_GET['stylesheet']; // = ‘file:///etc/passwd’
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $stylesheet
]);
Ensure your usage cannot allow in any case a user to pass a free input directly to the Snappy library.
// Bad example
$pdf = new Knp\Snappy\Pdf(‘/usr/local/bin/wkhtmltopdf’);
$pdf->generate(‘page.html’, ‘out.pdf’, [
‘xsl-style-sheet’ => $_GET['input'],
]);
Instead you can list available available stylesheets and pick the right one with the user input.
// Better
$allowedStylesheets = [
'invoice' => '/app/xsl/invoice.xsl',
'report' => '/app/xsl/report.xsl',
];
$key = $_GET['stylesheet'] ?? '';
if (!array_key_exists($key, $allowedStylesheets)) {
throw new \RuntimeException('Unknown stylesheet.');
}
$pdf = new Knp\Snappy\Pdf('/usr/local/bin/wkhtmltopdf');
$pdf->generate('page.html', 'out.pdf', [
'xsl-style-sheet' => $allowedStylesheets[$key],
]);
Impact
It impacts applications where:
It could happens with this kind of workflows:
Patches
A list a schema with
httpandhttpsby default is used to validate the remote path by default.Workarounds
Ensure your usage cannot allow in any case a user to pass a free input directly to the Snappy library.
Instead you can list available available stylesheets and pick the right one with the user input.
References
Read more about SSRF at owasp.org/www-community/attacks/Server_Side_Request_Forgery