PT-2024-40217 · Dompdf+2 · Dompdf+2

Published 2024-02-22 · Updated 2024-02-22

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: dompdf (affected versions not specified)

Description: The issue arises from a lack of sanitization in the font path returned by php-svg-lib, which can be exploited when an inline CSS font is defined. This can lead to metadata unserializing on a PHAR file through the phar:// URL handler on PHP versions prior to 8.0. On other versions, it might be used to achieve a Server-Side Request Forgery (SSRF) through protocols like ftp, bypassing authorized protocols configured on dompdf. The problem lies in the openFont function of the lib/Cpdf.php library, where the $font variable passed by php-svg-lib isn't checked correctly. An attacker might exploit this vulnerability to call arbitrary URLs with arbitrary protocols if they can force dompdf to parse a SVG with an inline CSS property using a malicious font-family.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-73

CWE-502

Related Identifiers

GHSA-97M3-52WR-XVV2

Affected Products

Php

Dompdf

Php-Svg-Lib

References · 5

• https://osv.dev/vulnerability/GHSA-97m3-52wr-xvv2 · Vendor Advisory
• https://github.com/dompdf/dompdf · Note
• https://github.com/dompdf/dompdf/security/advisories/GHSA-97m3-52wr-xvv2 · Note
• https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa · Note
• https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273 · Note