CVE-2009-5067

html2ps - 'include file' Server-Side Include Directive Directory Traversal

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2009-5067 has a selected CVSS score of 4.3; EIP currently links 1 catalogued exploit.

Description

Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBhtml2ps - 'include file' Server-Side Include Directive Directory TraversalExploitDB exploitby epiphantExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The Python script generates an HTML file containing a Server-Side Include (SSI) directive with a directory traversal payload ('../../../../../../../etc/passwd') and then executes the 'html2ps' command on this file. This is intended to exploit a path traversal vulnerability in html2ps to read arbitrary files on the system.

Backdoor review

No backdoor observed in reviewed code

The provided Python script is a straightforward proof-of-concept (PoC) for CVE-2009-5067. It generates a static HTML file containing a directory traversal payload and then invokes the vulnerable 'html2ps' tool to process it. The script itself performs no backdoor behavior, such as establishing persistence, exfiltrating data, or downloading additional payloads. The only actions are writing a local file and executing two local commands, which are consistent with demonstrating the described vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwarehtml2ps
Attack typesDirectory Traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively generates a malicious HTML file and executes the vulnerable 'html2ps' command to exploit the directory traversal vulnerability, which constitutes an exploit.

exploits/multiple/webapps/10012.py:30exploits/multiple/webapps/10012.py:44

Requirements

  • html2ps must be installed and accessible in the system path.exploits/multiple/webapps/10012.py:44
  • The 'ssi' option must be enabled in the html2ps configuration (which is the default).exploits/multiple/webapps/10012.py:11-12

Observed behavior

  • Creates an HTML file named 'epiphant.html' containing an SSI include directive with a directory traversal payload.exploits/multiple/webapps/10012.py:23-34
  • Executes the 'html2ps' command on the crafted HTML file, which would trigger the SSI directive and attempt to read '/etc/passwd'.exploits/multiple/webapps/10012.py:44
  • Opens the resulting PostScript file with 'gv' to display the contents of the disclosed file.exploits/multiple/webapps/10012.py:45
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
Payload withheldThe script writes a static HTML file to the current working directory.exploits/multiple/webapps/10012.py:37
Command Execution
Payload withheldThe script executes the vulnerable 'html2ps' tool on the generated HTML file to trigger the directory traversal vulnerability.exploits/multiple/webapps/10012.py:44
Command Execution
Payload withheldThe script opens the generated PostScript file with 'gv' (GhostView) to display the output, which is a standard way to view the result of the PoC.exploits/multiple/webapps/10012.py:45
Review boundaries

What the analysis did not establish

  • The script is a local exploit that requires the attacker to have write access to the file system to create the HTML file and execute commands.
  • The script assumes the target system has 'html2ps' and 'gv' installed and configured with SSI enabled.
  • The review is limited to the supplied Python script. The behavior of the external 'html2ps' and 'gv' commands, which are not part of the artifact, is not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

9