CVE-2024-39919: 
JavaScript vulnerability analysis and mitigation

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. The vulnerability was discovered in versions prior to 2.1.1, where the package includes an ALLOW_LIST functionality that by default permits capturing screenshots of web services running on localhost, 127.0.0.1, or the [::]. This vulnerability was assigned CVE-2024-39919 and was disclosed on July 15, 2024 (GitHub Advisory).

The vulnerability stems from the package's default configuration which allows capturing screenshots of web services running on localhost addresses. The package includes an ALLOW_LIST feature where hosts can specify permitted services for screenshot capture, but by default, it allows access to localhost (127.0.0.1) and [::] addresses. The vulnerability has been assigned a CVSS v3.1 score of 3.1 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

If the package is hosted on a server, unauthorized users could potentially capture screenshots of other web services running locally on that server, potentially exposing sensitive information from internal web services that are not intended for public access (GitHub Advisory).

The vulnerability can be exploited by sending requests to capture screenshots using localhost URLs in various formats: http://[::]:port, http://localhost:port, or http://127.0.0.1:port. A proof of concept demonstrates that an attacker can capture screenshots of private local services running on different ports (GitHub Advisory).

The vulnerability has been addressed in version 2.1.1 with the addition of a blocklist feature. Users are advised to upgrade to this version. The fix implements a BLOCK_LIST environment variable that can be used to specify domains that should be blocked from screenshot capture (GitHub Commit).