Recursive Chaining Vulnerability in Dompdf Package Could Lead to Resource Exhaustion
Summary
CVE-2023-50262: Dompdf is an HTML to PDF converter for PHP. Affects php-dompdf versions < 41cbac16f3cf56affa49f06e8dae66d0eac2b593. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompdf is an open-source HTML to PDF converter for PHP, widely used for generating PDF documents from HTML content. It supports various features such as SVG images, CSS styles, and more. However, prior to version 2.0.4, Dompdf had a vulnerability in its SVG image parsing mechanism that allowed for recursive chaining of SVG references, potentially leading to significant resource exhaustion.
Vulnerability Detail
The vulnerability arises from Dompdf's inadequate validation of SVG references, specifically in scenarios where multiple SVG documents reference each other. This oversight allows a malicious actor to create a chain of SVG references that can lead to infinite recursion. When Dompdf processes such a malicious payload, it may exceed the allowed execution time or memory usage, causing the application to crash. An attacker could exploit this by sending multiple requests, leading to denial of service as the system becomes unable to handle incoming requests. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can limit the number of SVG references in their documents or avoid using SVG images that reference other SVG files until the package is updated. Additionally, implementing rate limiting on incoming requests may help mitigate the impact of potential attacks.
Conclusion
The vulnerability in Dompdf related to recursive SVG references poses a significant risk to applications using this package. Upgrading to version 2.0.4 or later is essential to mitigate this risk. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for php-dompdf →
FAQ
The vulnerability allows for recursive chaining of SVG references, which can lead to resource exhaustion and denial of service.
You can use Vulert's playground to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include application crashes, denial of service, and resource exhaustion on the server.
Yes, version 2.0.4 and later of Dompdf contains a fix for this vulnerability.
If an immediate upgrade is not possible, consider implementing rate limiting and avoiding SVG references in your documents as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
