PT-2022-22910 · Unknown+1 · Wkhtmltopdf+1

Published 2022-08-22 · Updated 2025-11-24 · CVE-2022-35583

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wkhtmlTOpdf version 0.12.6

Description The issue allows an attacker to gain initial access into the target's system by injecting an iframe tag with the initial asset IP address on its source. This enables the attacker to potentially take over the whole infrastructure by accessing internal assets.

Recommendations For wkhtmlTOpdf version 0.12.6, consider disabling the ability to inject iframe tags as a temporary workaround until a patch is available. Restrict access to internal assets to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-35583

Affected Products

Debian

Wkhtmltopdf

References · 16

• 🔥 https://exploit-db.com/exploits/51039 · Exploit
• 🔥 https://cyber-guy.gitbook.io/cyber-guys-blog/blogs/initial-access-via-pdf-file-silently · Exploit
• 🔥 http://packetstormsecurity.com/files/171446/wkhtmltopdf-0.12.6-Server-Side-Request-Forgery.html · Exploit
• 🔥 https://drive.google.com/file/d/1LAmf_6CJLk5qDp0an2s_gVQ0TN2wmht5/view?usp=sharing · Exploit
• https://security-tracker.debian.org/tracker/CVE-2022-35583 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-35583 · Security Note
• https://wkhtmltopdf.org · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35583 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35583 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-35583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-35583 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-35583 · Vendor Advisory
• https://github.com/wkhtmltopdf/wkhtmltopdf/issues/5249 · Note
• https://t.me/cvenotify/46808 · Telegram Post
• https://t.me/cveNotify/143878 · Telegram Post