PT-2024-11000 · Dompdf · Dompdf

Published 2024-11-15 · Updated 2024-11-19 · CVE-2021-3902

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dompdf versions prior to 2.0.0

Description An improper restriction of external entities (XXE) vulnerability in dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue can be exploited even if the isRemoteEnabled option is set to false, allowing attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider disabling the SVG parser in dompdf until a patch is available. Restrict access to internal image files to minimize the risk of exploitation. Avoid using the isRemoteEnabled option set to false as it does not prevent the vulnerability from being exploited.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2021-3902

GHSA-3VJH-XRHF-V9XH

Affected Products

Dompdf

References · 11

• 🔥 https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1 · Exploit
• https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799 · Patch
• https://security-tracker.debian.org/tracker/CVE-2021-3902 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3902 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3902 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vjh-xrhf-v9xh · Vendor Advisory
• https://github.com/dompdf/dompdf · Note
• https://twitter.com/CVEnew/status/1857381731227295952 · Twitter Post
• https://t.me/cvenotify/101804 · Telegram Post
• https://t.me/cvedetector/11068 · Telegram Post