by Kastro
Paper/Archive/CVE-2022-35583

CVE-2022-35583

mitre — wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag…

EPSS 16%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 97.0.970 × 2019.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwkhtmltopdf.orgrefdrive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharingrefcyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silentlyrefpacketstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html