Description
BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
alam00000 bentopdf
< 2.8.7affected
References
- https://github.com/alam00000/bentopdf/security/advisories/GHSA-wh78-rcw2-hhg9 ↗
- https://github.com/alam00000/bentopdf/commit/45496fcd2ed6e02dcdde0d3839cc5024c091760c ↗
- https://github.com/alam00000/bentopdf/commit/58cd1a8893bfe06e4a59a72adc2e7db00a8b9266 ↗
- https://github.com/alam00000/bentopdf/releases/tag/v2.8.7 ↗