GitHub Advisoryadvisory · Packagist

GHSA-577p-7j7h-2jgf Deserialization of Untrusted Data in dompdf/dompdf

CRITICAL Published 2024-11-15 Modified 2024-11-18 Official page ↗
Aliases
CVE-2021-3838
Ecosystem
Packagist
Packages
dompdf/dompdf
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-11-15

Affected packages

• Packagist dompdf/dompdf: < 2.0.0 → fixed in 2.0.0

Description

DomPDF before version 2.0.0 is vulnerable to PHAR (PHP Archive) deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.

Related

Alias · CVE (1)

  • CVE-2021-3838 DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References