CVE-2023-37290
📋 TL;DR
This vulnerability in InfoDoc Document On-line Submission and Approval System allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks through HTML-to-PDF conversion. Attackers can access arbitrary system files and map internal network topology. Any organization using the vulnerable InfoDoc system is affected.
💻 Affected Systems
- InfoDoc Document On-line Submission and Approval System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete internal network compromise, sensitive data exfiltration, lateral movement to critical systems, and potential ransomware deployment.
Likely Case
Internal network reconnaissance, credential harvesting from internal services, and unauthorized access to sensitive files.
If Mitigated
Limited to port scanning internal services and accessing only publicly accessible internal resources.
🎯 Exploit Status
Simple SSRF via iframe tags makes exploitation straightforward for attackers with basic web knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-7226-12195-1.html
Restart Required: Yes
Instructions:
1. Contact InfoDoc vendor for patch. 2. Apply vendor-provided security update. 3. Restart application services. 4. Test HTML-to-PDF functionality.
🔧 Temporary Workarounds
Input Validation for HTML Tags
allImplement strict validation to block iframe and other resource-loading tags in HTML input
Implement server-side regex filtering for <iframe>, <img>, <script> tags with src attributes
Network Segmentation
allRestrict InfoDoc server's outbound network access to prevent SSRF
Configure firewall to block all outbound traffic from InfoDoc server except required services
🧯 If You Can't Patch
- Disable HTML-to-PDF conversion functionality entirely
- Implement WAF rules to block requests containing iframe tags and SSRF patterns
🔍 How to Verify
Check if Vulnerable:
Test if HTML input containing <iframe src="http://internal-service/"> triggers PDF generation with embedded contentCheck Version:
Check application version via admin interface or contact vendorVerify Fix Applied:
Attempt SSRF payloads after patch - should be blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual HTML tags in PDF generation requests
- Outbound requests from application server to internal IPs
- Multiple failed PDF generation attempts
Network Indicators:
- InfoDoc server making unexpected outbound HTTP requests
- Traffic to internal services from application server
SIEM Query:
source="infodoc" AND (message="*iframe*" OR message="*src=*" OR message="*PDF generation*")