CVE-2010-4879: DOMPDF Remote File Inclusion Vulnerability in dompdf/dompdf
Summary
CVE-2010-4879: DOMPDF Remote File Inclusion Vulnerability. Affects dompdf/dompdf versions >= 0.6, < 0.6.1. Fixed in 0.6.1. How to fix ↓
Also tracked for
- php-dompdf · Debian:11
The same CVE-2010-4879 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dompdf is a PHP library that allows for the generation of PDF files from HTML content. It is commonly used in web applications to dynamically generate PDF documents. The vulnerability in question, identified as CVE-2010-4879, is a remote file inclusion vulnerability that affects dompdf version 0.6.0 beta1. This vulnerability allows remote attackers to execute arbitrary PHP code by exploiting the input_file parameter in the dompdf.php file.
Vulnerability Detail
The remote file inclusion vulnerability in dompdf.php allows an attacker to manipulate the input_file parameter with a specially crafted URL, leading to the execution of arbitrary PHP code. This can result in unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability is rated as HIGH severity and has been assigned CWE-94. It was first published on 2022-05-17 and last modified on 2024-04-25.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
composer require dompdf/dompdf:0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the fix by upgrading to dompdf version 0.6.1 or later.
Conclusion
The DOMPDF Remote File Inclusion Vulnerability in dompdf version 0.6.0 beta1 poses a significant risk to systems using this library. To mitigate the vulnerability, it is crucial to upgrade to dompdf version 0.6.1 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
dompdf is a PHP library used for generating PDF files from HTML content.
A remote file inclusion vulnerability allows an attacker to include remote files or execute arbitrary code by manipulating input parameters.
The vulnerability can lead to the execution of arbitrary PHP code, potentially resulting in unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, upgrade to dompdf version 0.6.1 or later.
No, there is no known workaround. It is essential to apply the fix by upgrading to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
