WeasyPrint hat einen Server-Side Request Forgery (SSRF) Schutz-Bypass über HTTP Redirect

The SSRF bypass in WeasyPrint allows attackers to craft malicious requests that are internally routed by the application. Even if a developer has implemented a custom url_fetcher to block access to specific URLs or domains, this vulnerability allows attackers to bypass that protection by leveraging HTTP redirects. This can enable access to sensitive internal services running on localhost, such as databases, administration panels, or cloud metadata endpoints (e.g., AWS instance metadata). Successful exploitation could lead to data exfiltration, privilege escalation, and potentially complete system compromise. The impact is particularly severe in environments where WeasyPrint is used to generate documents from untrusted sources, as an attacker could inject malicious URLs into the document, triggering the SSRF vulnerability during document processing.

Organizations using WeasyPrint to generate documents from untrusted sources are particularly at risk. This includes applications that process user-supplied URLs or data that is subsequently used in document generation. Shared hosting environments where multiple applications share the same WeasyPrint instance are also vulnerable, as a compromise in one application could potentially be leveraged to exploit this SSRF vulnerability in others.

• python / server:

import requests
from urllib.parse import urlparse

def check_redirects(url):
    try:
        response = requests.get(url, allow_redirects=True)
        parsed_url = urlparse(response.url)
        if parsed_url.netloc != urlparse(url).netloc:
            print(f"Potential SSRF bypass detected: URL redirected to {response.url}")
    except requests.exceptions.RequestException as e:
        print(f"Error checking URL: {e}")

# Example usage (replace with WeasyPrint-related URLs)
check_redirects("http://localhost:8000/internal")

• generic web:

curl -I 'http://your-weasyprint-server/some/url' | grep 'Location:'

1. 2026-01-20Disclosure

   disclosure

1. Reserviert2025-12-19
2. Veröffentlicht2026-01-20
3. Geändert2026-04-15
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-68616 is to upgrade to WeasyPrint version 68.0 or later, which addresses the underlying HTTP redirect handling issue. If upgrading is not immediately feasible, consider implementing stricter network segmentation to limit the potential blast radius of a successful SSRF attack. Additionally, carefully review and validate all URLs used by WeasyPrint, especially those originating from untrusted sources. While not a complete solution, implementing a Web Application Firewall (WAF) with SSRF protection rules can provide an additional layer of defense. Monitor WeasyPrint logs for unusual outbound requests to internal or unexpected external resources.