CVE-2021-32698: Server-Side Request Forgery (SSRF) (CWE-918)
value: eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 4.9
Published: 2021-06-21T22:15Z
Repository: https://github.com/elabftw/elabftw
Language: PHP
Files changed: src/services/MakePdf.php
Commit date: 2021-06-11 21:29:33 +0200
Commit message: security: prevent blind ssrf in pdf generation

Issue: one could set the src attribute of an img tag to anything they
want and the pdf generation will happily GET it. This means that one can
do arbitrary HTTP GET requests from the server itself. This doesn't work
in the browser context because of the restrictive CSP policy, which is
not applied during the pdf generation.

This is a MINOR vulnerability as other security measures in the PHP
configuration prevents prospective escalation.

The vulnerability was reported by @mgrRaf and @xoffense. Thank to them
for responsible disclosure. A bounty has been awarded.

Diff: diff --git a/src/services/MakePdf.php b/src/services/MakePdf.php
index 25f541c3d..3f1384d98 100644
--- a/src/services/MakePdf.php
+++ b/src/services/MakePdf.php
@@ -135,11 +135,15 @@ class MakePdf extends AbstractMake
             'url' => $this->getUrl(),
             'linkBaseUrl' => Tools::getUrl($Request) . '/database.php',
             'useCjk' => $this->Entity->Users->userData['cjk_fonts'],
         );
 
-        return $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);
+        $html = $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);
+
+        // now remove any img src pointing to outside world
+        // prevent blind ssrf (thwarted by CSP on webpage, but not in pdf)
+        return preg_replace('/img src=("|\')(ht|f|)tp/i', 'nope', $html);
     }
 
     /**
      * Generate pdf and return it as string
      */
@@ -216,11 +220,11 @@ class MakePdf extends AbstractMake
         // decode html entities, otherwise it crashes
         // compare to https://github.com/mathjax/MathJax-demos-node/issues/16
         $contentDecode = html_entity_decode($content, ENT_HTML5, 'UTF-8');
         file_put_contents($filename, $contentDecode);
 
-        // apsolute path to tex2svg app
+        // absolute path to tex2svg app
         $appDir = dirname(__DIR__, 2) . '/src/node';
 
         // convert tex to svg with mathjax nodejs script
         // returns nothing if there is no tex
         // use tex2svg.bundle.js script located in src/node

Vulnerable code:         return $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);
        // apsolute path to tex2svg app
Fixed code:         $html = $this->getTwig(Config::getConfig())->render('pdf.html', $renderArr);

        // now remove any img src pointing to outside world
        // prevent blind ssrf (thwarted by CSP on webpage, but not in pdf)
        return preg_replace('/img src=("|\')(ht|f|)tp/i', 'nope', $html);
        // absolute path to tex2svg app