PT-2023-31515 · Dompdf+1 · Dompdf+1

Bsweeney · Publicado 2023-12-13 · Atualizado 2023-12-19 · CVE-2023-50262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 2.0.4

Description The issue arises when Dompdf parses SVG images, as it performs an initial validation to ensure that paths within the SVG are allowed. However, prior to version 2.0.4, a recursive chain using two or more SVG documents is not correctly validated. This could exhaust the memory available to the executing process and/or to the server itself. A malicious actor may trigger infinite recursion by chaining references between two or more SVG images, potentially causing resource exhaustion.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the processing of SVG images referenced by an image element until a patch is available. Restrict access to the php-svg-lib module to minimize the risk of exploitation. Avoid using the image element in SVG images until the issue is resolved.

Exploit

Correção

Uncontrolled Recursion

RCE

Enumeração de Fraquezas

CWE-674

CWE-20

Identificadores relacionados

CVE-2023-50262

GHSA-3QX2-6F78-W2J2

Produtos afetados

Debian

Dompdf

Referências · 15

• 🔥 https://github.com/dompdf/dompdf/security/advisories/GHSA-3qx2-6f78-w2j2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50262.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2023-50262.yaml · Exploit
• https://github.com/dompdf/dompdf/commit/41cbac16f3cf56affa49f06e8dae66d0eac2b593 · Correção
• https://github.com/dompdf/dompdf/blob/v2.0.3/src/Image/Cache.php#L136-L153 · Nota
• https://github.com/dompdf/dompdf · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50262 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50262 · Nota de Segurança
• https://twitter.com/RedPacketSec/status/1736326325781110969 · Publicação no Twitter
• https://t.me/cvenotify/64167 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2023-50262 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1735084311726919815 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-3qx2-6f78-w2j2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-50262 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1735045561039118671 · Publicação no Twitter