HTML TO PDF RENDERER: A TALE OF LOCAL FILE ACCESS AND SHELLCODE EXECUTION

Summary from the TLDR InfoSec newsletter

In a recent engagement, a penetration tester from Neodyme tested a tool that converted HTML to PDF. The tester's first instinct was to attempt Server-Side Request Forgery (SSRF), which they succeeded in doing in a test environment. They then discovered that they could enumerate information about the engine and local files. The tester then found an exploit against the outdated Chromium browser used by the converter to render the HTML and adapted it to obtain shellcode execution on the server.