Listen to this Post
How the Mentioned CVE Works
The vulnerability CVE-2024-27490 exists in WeasyPrint’s `default_url_fetcher` function. It allows for Server-Side Request Forgery (SSRF) protection bypass via HTTP redirects. Developers can implement custom `url_fetcher` functions to block access to internal resources (like localhost or cloud metadata). However, the underlying `urllib.request.urlopen` library automatically follows HTTP redirects (301, 302, 307) without re-invoking the developer’s custom security validation logic for the new, redirected URL. This creates a Time-of-Check-Time-of-Use (TOCTOU) flaw. An attacker can supply an initial URL that passes the security check (e.g., using an IP address instead of a blocked hostname) but which redirects to a blocked internal target. The fetch proceeds to the restricted destination without the security filter being applied again, enabling access to sensitive internal services.
Platform: WeasyPrint
Version: <= 61.0
Vulnerability: SSRF Bypass
Severity: Critical
date: 2024-02-28
Prediction: 2024-04-15 Patch
What Undercode Say:
Analytics
Simulate internal service python3 victim.py Host redirector python3 attacker.py Run exploit python3 exploit.py Extract PDF data pdfdetach -list exploit.pdf pdfdetach -saveall exploit.pdf cat secret
How Exploit:
Attacker controls an external server that returns an HTTP redirect (302) to a blocked internal resource (e.g., http://localhost:5000/secret` orhttp://169.254.169.254/latest/meta-data/`). The victim application uses a custom `url_fetcher` that blocks strings like “localhost”. The attacker provides a URL to their redirector (e.g., http://attacker.com/image.png`). WeasyPrint's default fetcher checks the initial URL, allows it, and then `urllib` automatically follows the redirect to the blocked target, fetching the sensitive data.allow_redirects=False`. Validate the final URL after any redirects manually within the custom fetcher logic. Apply strict network-level egress filtering for the rendering service. Update to WeasyPrint version >= 62.0.
<h2 style="color: blue;">Protection from this CVE</h2>
Disable automatic redirect following in custom `url_fetcher` by using `urllib.request.build_opener(NoRedirect)` or a library like `requests` with
Impact:
Internal network reconnaissance. Cloud metadata exfiltration. Bypass of security controls. Data extraction from internal services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
