Remote Code Execution Vulnerability in php-dompdf: CVE-2014-5013
Summary
CVE-2014-5013: DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383. Affects php-dompdf versions < 0.6.2+dfsg-1. Fixed in 0.6.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that enables the conversion of HTML to PDF documents. It is widely used in web applications to generate dynamic PDF files from HTML content. The library supports various features such as CSS styling, image embedding, and font management. However, prior to version 0.6.2, php-dompdf was susceptible to a critical vulnerability that allowed remote code execution, posing significant security risks to applications utilizing this library.
Vulnerability Detail
CVE-2014-5013 is a vulnerability in php-dompdf that allows remote code execution due to improper handling of user input. An attacker could exploit this vulnerability by sending specially crafted requests to the application, leading to the execution of arbitrary PHP code on the server. This could result in unauthorized access to sensitive data, manipulation of application logic, or complete server compromise. The vulnerability is particularly severe, with a CVSS score of 8.8, indicating a high level of risk.
How To Fix
Minimum fixed version
0.6.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of exploitation. Ensure that user inputs are properly filtered and do not allow execution of arbitrary code. Additionally, restrict access to the php-dompdf library to trusted users only.
Conclusion
CVE-2014-5013 is a critical vulnerability in the php-dompdf library that allows remote code execution. It is essential for users of this library to update to the latest version to protect their applications from potential exploitation. Implementing security best practices can further mitigate risks.
See every vulnerability recorded for php-dompdf →
FAQ
CVE-2014-5013 is a vulnerability in the php-dompdf library that allows remote code execution due to improper handling of user input.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities. You can test your application without signup using the Vulert playground.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and complete server compromise, posing significant risks to your application.
To update php-dompdf, use your package manager. For Debian-based systems, run 'sudo apt-get update' followed by 'sudo apt-get install php-dompdf'.
Yes, you can implement input validation and sanitization to reduce the risk of exploitation, and restrict access to the library to trusted users.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
