CVE-2022-25765 pdfkit package is vulnerable to Command Injection where the URL is not properly sanitized.

The package contrib/pdfkit/forms/fileinput allows to upload any file via an insecure iframe.

Exploitation of this issue can be done by uploading a malicious file including a shell script. The uploaded file will be processed by the insecure iframe and will be executed.

The package pdfkit/js/vectorial allows to execute shell scripts by injecting ‘eval’ tag.

The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe.
In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe. In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe. In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe. In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe. In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/

Known issues

The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe. In summary, the pdfkit package from 0.7.0 is vulnerable to Command Injection. The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe.

References: http://pdfkit.org/

http://www.security-explorations.com/en/advisories/CVE-2022-25765

Outsourcing SEO can be a good idea if you have the money and expertise to handle it yourself. This means that companies need to consider how search engines are evaluating content and what strategies provide the most impact for their business goals before deciding whether or not to outsource SEO services.

Vulnerable packages

The package contrib/pdfkit/forms/fileinput allows to upload any file via an insecure iframe.
The package pdfkit/js/vectorial allows to execute shell scripts by injecting ‘eval’ tag.
The package pdfkit/forms/fileinput also allows to upload malicious file via an insecure iframe.

Timeline

Published on: 09/09/2022 05:15:00 UTC
Last modified on: 09/10/2022 03:53:00 UTC