PT-2023-31515 · Dompdf+1 · Dompdf+1

Bsweeney · Published 2023-12-13 · Updated 2023-12-19 · CVE-2023-50262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dompdf versions prior to 2.0.4

Description The issue arises when Dompdf parses SVG images, as it performs an initial validation to ensure that paths within the SVG are allowed. However, prior to version 2.0.4, a recursive chain using two or more SVG documents is not correctly validated. This could exhaust the memory available to the executing process and/or to the server itself. A malicious actor may trigger infinite recursion by chaining references between two or more SVG images, potentially causing resource exhaustion.

Recommendations For versions prior to 2.0.4, update to version 2.0.4 or later to resolve the issue. As a temporary workaround, consider disabling the processing of SVG images referenced by an image element until a patch is available. Restrict access to the php-svg-lib module to minimize the risk of exploitation. Avoid using the image element in SVG images until the issue is resolved.

Exploit

Fix

Uncontrolled Recursion

RCE

Weakness Enumeration

CWE-674

CWE-20

Related Identifiers

CVE-2023-50262

GHSA-3QX2-6F78-W2J2

Affected Products

Debian

Dompdf

References · 15

• 🔥 https://github.com/dompdf/dompdf/security/advisories/GHSA-3qx2-6f78-w2j2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50262.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2023-50262.yaml · Exploit
• https://github.com/dompdf/dompdf/commit/41cbac16f3cf56affa49f06e8dae66d0eac2b593 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-50262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50262 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-50262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qx2-6f78-w2j2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50262 · Vendor Advisory
• https://github.com/dompdf/dompdf/blob/v2.0.3/src/Image/Cache.php#L136-L153 · Note
• https://github.com/dompdf/dompdf · Note
• https://twitter.com/RedPacketSec/status/1736326325781110969 · Twitter Post
• https://t.me/cvenotify/64167 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1735084311726919815 · Twitter Post
• https://twitter.com/CVEnew/status/1735045561039118671 · Twitter Post