PT-2023-12337 · Php+6 · Php+6
Publicado
2022-06-18
·
Atualizado
2025-12-30
·
CVE-2021-3838
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DomPDF versions prior to 2.0.0
Description
The issue is related to PHAR deserialization due to a lack of checking on the protocol before passing it into the
file get contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.Recommendations
For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent exploitation. Additionally, restrict access to the
file get contents() function to minimize the risk of remote code execution.Exploit
Correção
RCE
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Debian
Dompdf
Laravel
Linuxmint
Php
Ubuntu