Cross-site Scripting (XSS)

Vulnerability

Overview

CVE-2020-7691 is a Cross-site Scripting (XSS) vulnerability affecting all versions of the jsPDF library prior to 2.0.0. The core issue lies in the filtering mechanism used by the fromHTML method, which attempts to sanitize HTML input before converting it to PDF. The regex-based filter can be bypassed using a crafted payload such as <script>, allowing an attacker to inject arbitrary JavaScript [2].

Exploitation

An attacker can exploit this vulnerability by supplying a malicious HTML string containing the bypass sequence as input to the fromHTML method. The proof-of-concept (PoC) provided demonstrates that when a PDF is generated using the flawed fromHTML API, the injected script executes in the context of the application's domain. No authentication is required beyond the ability to instruct the library to process untrusted HTML, making it exploitable in any application that uses jsPDF to render user-controlled content [2][4].

Impact

Successful exploitation results in stored or reflected XSS, depending on how the PDF is delivered. An attacker could steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim within the vulnerable application. The injected script runs in the user's browser when the PDF is generated or viewed, bypassing the intended HTML sanitization [2].

Mitigation

The vulnerability has been fixed in jsPDF version 2.0.0 and later. Users of the WebJar variant org.webjars.bowergithub.mrrio:jspdf should upgrade to version 2.3.1 or higher [4]. For the org.webjars:jspdf package, no fixed version is available; users must update to a different distribution or apply external input sanitization [3].