Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /get-info-on-pdf endpoint. By uploading a specially crafted PDF file containing malicious JavaScript payloads in its metadata (Title or Author fields), an attacker can trigger execution of arbitrary JavaScript in any user’s browser who views the resulting page.
Details
The affected functionality extracts only the Title and Author metadata fields from uploaded PDF files and renders them back to the client via the /get-info-on-pdf page. These values are directly embedded into the returned HTML without proper HTML encoding or sanitization.
Because characters such as <, >, and " are not escaped, an attacker can inject arbitrary HTML or JavaScript into the response. This results in execution of attacker-controlled code in the context of the application's domain.
The root cause is the lack of output encoding for these untrusted PDF metadata fields (Title and Author).
Example vulnerable flow:
- A PDF file is uploaded with metadata containing special characters.
- The application parses the metadata and returns it inside the HTML response.
- The browser interprets injected tags/scripts, leading to XSS execution.
PoC
Steps to reproduce:
- Create a PDF file and set its Title or Author metadata field to the following payload:
<img src=x onerror=alert(1)>
-
Upload the crafted PDF file via the /get-info-on-pdf endpoint.
-
Open the resulting page in a web browser.
-
The JavaScript payload (alert(1)) will execute immediately upon page load, confirming the metadata is rendered without proper sanitization and enabling reflected XSS.
Impact
- Type of vulnerability: Reflected Cross-Site Scripting (XSS).
- Who is impacted: Any user who views the result of a specially crafted PDF uploaded to /get-info-on-pdf.
Potential attacker actions:
- Execute arbitrary JavaScript in the context of the application.
- Manipulate page content, redirect users, or perform phishing attacks.
- Exfiltrate sensitive client-side data accessible in the browser (cookies, localStorage, DOM data).
This vulnerability allows an attacker to compromise the integrity and confidentiality of the client-side environment, posing a significant security risk.
Szym0n13k Reporter
Summary
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /get-info-on-pdf endpoint. By uploading a specially crafted PDF file containing malicious JavaScript payloads in its metadata (Title or Author fields), an attacker can trigger execution of arbitrary JavaScript in any user’s browser who views the resulting page.
Details
The affected functionality extracts only the Title and Author metadata fields from uploaded PDF files and renders them back to the client via the /get-info-on-pdf page. These values are directly embedded into the returned HTML without proper HTML encoding or sanitization.
Because characters such as <, >, and " are not escaped, an attacker can inject arbitrary HTML or JavaScript into the response. This results in execution of attacker-controlled code in the context of the application's domain.
The root cause is the lack of output encoding for these untrusted PDF metadata fields (Title and Author).
Example vulnerable flow:
PoC
Steps to reproduce:
<img src=x onerror=alert(1)>Upload the crafted PDF file via the /get-info-on-pdf endpoint.
Open the resulting page in a web browser.
The JavaScript payload (alert(1)) will execute immediately upon page load, confirming the metadata is rendered without proper sanitization and enabling reflected XSS.
Impact
Potential attacker actions:
This vulnerability allows an attacker to compromise the integrity and confidentiality of the client-side environment, posing a significant security risk.