CVE-2024-28184
📋 TL;DR
CVE-2024-28184 is a vulnerability in WeasyPrint that allows attackers to bypass URL fetching restrictions and attach arbitrary file or URL content to generated PDF documents. This affects web developers and applications using WeasyPrint version 61.0 through 61.1 to generate PDFs from untrusted sources.
💻 Affected Systems
- WeasyPrint
📦 What is this software?
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Attackers could exfiltrate sensitive files from the server (including configuration files, credentials, or private data) by embedding them in generated PDFs, leading to data breach and system compromise.
Likely Case
Information disclosure where attackers can read arbitrary files accessible to the WeasyPrint process, potentially exposing application source code, configuration files, or other sensitive data.
If Mitigated
Limited impact if WeasyPrint runs with minimal file system permissions and processes only trusted input, though the vulnerability still exists.
🎯 Exploit Status
Exploitation requires the ability to control input to WeasyPrint, which is common in web applications that generate PDFs from user-provided content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 61.2
Vendor Advisory: https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
Restart Required: No
Instructions:
1. Upgrade WeasyPrint to version 61.2 or later using pip: 'pip install --upgrade weasyprint==61.2' 2. Verify the installation with: 'python -c "import weasyprint; print(weasyprint.__version__)"' 3. Test PDF generation functionality.
🔧 Temporary Workarounds
Restrict file system access
linuxRun WeasyPrint in a sandboxed environment with minimal file system permissions
chroot /path/to/sandbox
docker run --read-only -v /tmp:/tmp:ro ...
Input validation
allSanitize HTML/CSS input to remove file:// and other local URL schemes before passing to WeasyPrint
🧯 If You Can't Patch
- Implement strict input validation to reject any file:// URLs or local paths in HTML/CSS input
- Run WeasyPrint with minimal privileges using containerization or chroot to limit file system access
🔍 How to Verify
Check if Vulnerable:
Check WeasyPrint version: 'python -c "import weasyprint; print(weasyprint.__version__)"' - if version is 61.0 or 61.1, system is vulnerable.Check Version:
python -c "import weasyprint; print(weasyprint.__version__)"Verify Fix Applied:
After upgrading, verify version is 61.2 or higher and test that file:// URLs in HTML input no longer result in file content being embedded in PDFs.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns by WeasyPrint process
- Large PDF generation times for small inputs
- Multiple failed file access attempts in system logs
Network Indicators:
- PDF files containing unexpected binary data or file content
- Unusual outbound traffic patterns after PDF generation
SIEM Query:
process.name:"python" AND process.args:"weasyprint" AND file.path:"/etc/*" OR file.path:"/home/*" OR file.path:"/root/*"🔗 References
- https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598
- https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6/
- https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598
- https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6/
