Description
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
PDFMathTranslate PDFMathTranslate
Default version status: unaffected
0 to ≤ 1.9.11affected
pkg:pypi/pdf2zhReferences
- https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188 ↗
- https://github.com/PDFMathTranslate/PDFMathTranslate ↗
- https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L149-L179 ↗
- https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L257-L269 ↗
- https://www.vulncheck.com/advisories/pdfmathtranslate-through-1.9.11-ssrf-via-gradio-web-gui-link-input ↗