Critical PHP Remote File Inclusion Vulnerability in php-dompdf
Summary
CVE-2010-4879: PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter. Affects php-dompdf versions < 0.6.1+dfsg-1. Fixed in 0.6.1+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that converts HTML to PDF documents. It is widely used in web applications to generate PDF files dynamically. The library supports various features such as CSS styling, images, and more. However, an identified vulnerability in version 0.6.0 beta1 allows remote attackers to exploit the input_file parameter, leading to potential unauthorized code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2010-4879, is a remote file inclusion (RFI) flaw found in dompdf.php of php-dompdf version 0.6.0 beta1. This issue arises when user-supplied input is not properly sanitized, allowing attackers to include arbitrary PHP files from remote servers. If exploited, this can lead to unauthorized access, data breaches, or complete server compromise. The vulnerability affects multiple Debian ecosystems, including versions 11, 12, and 13.
How To Fix
Minimum fixed version
0.6.1+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not possible, consider disabling the input_file parameter or implementing strict input validation to prevent unauthorized file inclusion. Ensure that user inputs are sanitized and validated against a whitelist of acceptable values.
Conclusion
The CVE-2010-4879 vulnerability in php-dompdf poses significant risks to applications using the affected version. It is crucial to upgrade to a secure version to protect against potential exploitation. Implementing additional security measures can further safeguard your application.
See every vulnerability recorded for php-dompdf →
FAQ
CVE-2010-4879 is a remote file inclusion vulnerability in the php-dompdf library that allows attackers to execute arbitrary PHP code via the input_file parameter.
The vulnerability affects php-dompdf version 0.6.0 beta1. It is recommended to upgrade to version 0.6.1+dfsg-1 or later.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potentially full server compromise, allowing attackers to execute malicious code.
Yes, you can mitigate the risk by disabling the input_file parameter or implementing strict input validation to ensure only safe inputs are processed.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
