CVE-2022-35583

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-35583
wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html Exploit
https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently URL Repurposed
https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing Exploit Third Party Advisory
https://wkhtmltopdf.org/ Product Vendor Advisory
http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html Exploit
https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently URL Repurposed
https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing Exploit Third Party Advisory
https://wkhtmltopdf.org/ Product Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wkhtmltopdf:wkhtmltopdf:0.12.6:*:*:*:*:*:*:*
History

18 Mar 2025, 18:42

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html - () http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html - Exploit
References () https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently - Exploit, Third Party Advisory () https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently - URL Repurposed

21 Nov 2024, 07:11

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html - () http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html -
References () https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently - Exploit, Third Party Advisory () https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently - Exploit, Third Party Advisory
References () https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing - Exploit, Third Party Advisory () https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing - Exploit, Third Party Advisory
References () https://wkhtmltopdf.org/ - Product, Vendor Advisory () https://wkhtmltopdf.org/ - Product, Vendor Advisory

24 Mar 2023, 19:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html -
Information

Published : 2022-08-22 16:15

Updated : 2025-03-18 18:42

NVD link : CVE-2022-35583

Mitre link : CVE-2022-35583

CVE.ORG link : CVE-2022-35583

JSON object : View

Products Affected

wkhtmltopdf

  • wkhtmltopdf
CWE
CWE-918

Server-Side Request Forgery (SSRF)