CVEs-PoC/2020/CVE-2020-7740.md

### [CVE-2020-7740](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7740)
![](https://img.shields.io/static/v1?label=Product&message=node-pdf-generator&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%200%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Server-side%20Request%20Forgery%20(SSRF)&color=brighgreen)

### Description

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/CS4239-U6/node-pdf-generator-ssrf
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/soosmile/POC