Executive Summary

This vulnerability exists in Docling versions 2.82.0 up to but not including 2.91.0 when the HTML backend rendering feature is explicitly enabled. It involves the Playwright-based rendering feature which can execute JavaScript and allow unrestricted network access while processing untrusted HTML documents.

An attacker can craft malicious HTML that executes arbitrary JavaScript within the rendering context or makes unauthorized network requests to internal services.

This can lead to server-side request forgery (SSRF) attacks, data exfiltration, or even remote code execution within the rendering environment.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have serious impacts including unauthorized execution of JavaScript code, which may compromise the security of the system processing the documents.

• Potential for SSRF attacks allowing attackers to access internal services.
• Risk of data exfiltration through malicious network requests.
• Possibility of remote code execution in the rendering environment, leading to further system compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Docling to version 2.91.0 or later, where the issue is fixed.

Additionally, avoid enabling the HTML backend rendering feature with Playwright for untrusted HTML documents, as this feature allows JavaScript execution and unrestricted network access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows execution of arbitrary JavaScript and unrestricted network access when processing untrusted HTML documents, potentially leading to data exfiltration and unauthorized network requests.

Such risks could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive data against unauthorized access and exfiltration.

Specifically, the potential for data exfiltration and remote code execution could lead to breaches of confidentiality and integrity, violating regulatory requirements for protecting personal and health information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when the Docling library versions 2.82.0 to 2.90.0 are used with the HTML backend explicitly configured for rendering (using the render_page=True option). Detection involves identifying if your system or network is running a vulnerable version of Docling with this configuration enabled.

To detect potential exploitation or presence of this vulnerability, you can:

• Check the installed Docling version to see if it falls within the vulnerable range (2.82.0 to 2.90.0). For example, run: `pip show docling` or `pip list | grep docling`.
• Audit your application code or configuration for usage of the `render_page=True` option when processing HTML documents.
• Monitor network traffic for unusual outbound requests originating from the Docling rendering process, which could indicate exploitation attempts involving JavaScript execution or SSRF.

Specific commands to help detect the vulnerability or its exploitation might include:

• Listing installed Docling version: `pip show docling`
• Searching code for render_page usage: `grep -r 'render_page=True' /path/to/your/code`
• Monitoring network connections from the Docling process (example for Linux): `sudo netstat -tunp | grep python` or `sudo lsof -i -a -p $(pgrep -f docling)`
• Using packet capture tools like tcpdump or Wireshark to analyze suspicious outbound HTTP requests during document processing.

Useful 0 Not Useful 0