html2ps - 'include file' Server-Side Include Directive Directory Traversal

ExploitDBExploitDB exploitExploitEDB-10012

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The Python script generates an HTML file containing a Server-Side Include (SSI) directive with a directory traversal payload ('../../../../../../../etc/passwd') and then executes the 'html2ps' command on this file. This is intended to exploit a path traversal vulnerability in html2ps to read arbitrary files on the system.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept (PoC) for CVE-2009-5067. It generates a static HTML file containing a directory traversal payload and then invokes the vulnerable 'html2ps' tool to process it. The script itself performs no backdoor behavior, such as establishing persistence, exfiltrating data, or downloading additional payloads. The only actions are writing a local file and executing two local commands, which are consistent with demonstrating the described vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwarehtml2ps
Attack typesDirectory Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively generates a malicious HTML file and executes the vulnerable 'html2ps' command to exploit the directory traversal vulnerability, which constitutes an exploit.

exploits/multiple/webapps/10012.py:30exploits/multiple/webapps/10012.py:44

Requirements

  • html2ps must be installed and accessible in the system path.exploits/multiple/webapps/10012.py:44
  • The 'ssi' option must be enabled in the html2ps configuration (which is the default).exploits/multiple/webapps/10012.py:11-12

Observed behavior

  • Creates an HTML file named 'epiphant.html' containing an SSI include directive with a directory traversal payload.exploits/multiple/webapps/10012.py:23-34
  • Executes the 'html2ps' command on the crafted HTML file, which would trigger the SSI directive and attempt to read '/etc/passwd'.exploits/multiple/webapps/10012.py:44
  • Opens the resulting PostScript file with 'gv' to display the contents of the disclosed file.exploits/multiple/webapps/10012.py:45
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
open("epiphant.html", "w")The script writes a static HTML file to the current working directory.exploits/multiple/webapps/10012.py:37
Command Execution
os.system("html2ps epiphant.html > epiphant.ps")The script executes the vulnerable 'html2ps' tool on the generated HTML file to trigger the directory traversal vulnerability.exploits/multiple/webapps/10012.py:44
Command Execution
os.system("gv epiphant.ps")The script opens the generated PostScript file with 'gv' (GhostView) to display the output, which is a standard way to view the result of the PoC.exploits/multiple/webapps/10012.py:45
Review boundaries

What the analysis did not establish

  • The script is a local exploit that requires the attacker to have write access to the file system to create the HTML file and execute commands.
  • The script assumes the target system has 'html2ps' and 'gv' installed and configured with SSI enabled.
  • The review is limited to the supplied Python script. The behavior of the external 'html2ps' and 'gv' commands, which are not part of the artifact, is not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1