CVE-2022-35583 - wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source

Back Back to CVE browser

CRITICAL

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source

Published Aug 22, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 15.38%

Description

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (4)

http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html
Exploit
https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently
URL Repurposed
https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing
ExploitThird Party Advisory
https://wkhtmltopdf.org/
ProductVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html		Exploit
https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently		URL Repurposed
https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing		ExploitThird Party Advisory
https://wkhtmltopdf.org/		ProductVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 22, 2022

Updated Aug 3, 2024

Reserved Jul 11, 2022

Link CVE-2022-35583

CISA Vulnrichment

Updated n/a

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2022-35583

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-35583