PT-2019-11259 · Mpdf · Mpdf

Byqwert · Published 2019-02-04 · Updated 2022-05-14 · CVE-2019-1000005

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mPDF versions 7.1.7 and earlier

Description: The issue is related to a Deserialization of Untrusted Data vulnerability in the getImage() method of the Image/ImageProcessor class. This can result in arbitrary code execution, file write, etc. The attack is exploitable if an attacker hosts a crafted image on the victim server and triggers the generation of a PDF file with content <img src="phar://path/to/crafted/image">.

Recommendations: For mPDF versions 7.1.7 and earlier, update to version 7.1.8 to resolve the issue. As a temporary workaround, consider restricting the use of the getImage() method in the Image/ImageProcessor class until a patch is available. Avoid using the <img src> tag with phar:// protocol in PDF files until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-1000005

GHSA-3CWC-M7C2-QR86

Affected Products

Mpdf

References · 5

• 🔥 https://github.com/mpdf/mpdf/issues/949 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000005 · Security Note
• https://osv.dev/vulnerability/GHSA-3cwc-m7c2-qr86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1000005 · Vendor Advisory
• https://github.com/mpdf/mpdf · Note