Critical PHAR Deserialization Vulnerability in DomPDF Package
Summary
CVE-2021-3838: DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. Affects php-dompdf versions < 99aeec1efec9213e87098d42eb09439e7ee0bb6a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DomPDF is an open-source PHP library that enables developers to convert HTML to PDF documents. It is widely used in various web applications due to its ease of use and flexibility. However, prior to version 2.0.0, DomPDF is susceptible to a serious vulnerability that allows attackers to exploit file uploads, leading to potential remote code execution.
Vulnerability Detail
The vulnerability arises from a lack of validation on the protocol used in file uploads. Specifically, DomPDF does not adequately check the protocol before passing it to the file_get_contents() function. This oversight allows an attacker to upload a file with the phar:// protocol, which can then be unserialized to instantiate arbitrary PHP objects. This can lead to remote code execution, particularly in frameworks like Laravel that have known PHP Object Injection (POP) chains, making the vulnerability critical for applications using vulnerable versions of DomPDF.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing file upload restrictions to prevent the upload of PHAR files. Additionally, you can sanitize and validate all uploaded files to ensure they do not contain malicious content. Implementing strict file type checks can help mitigate the risk until the package is updated.
Conclusion
The DomPDF package is vulnerable to a critical PHAR deserialization issue that can lead to remote code execution. It is crucial for users to update to version 2.0.2 or later to mitigate this risk. In the meantime, implementing file upload restrictions can serve as a temporary workaround. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for php-dompdf →
FAQ
PHAR deserialization refers to the process of unserializing a PHAR file, which can lead to the execution of arbitrary PHP code if the file contains malicious payloads.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities. Simply upload your manifest file, like package-lock.json, to the Vulert playground at Vulert Scanner.
Failing to address this vulnerability can lead to remote code execution, allowing attackers to gain control over your server, access sensitive data, or disrupt services.
Yes, you can implement strict file upload controls and validate all uploaded files to prevent the exploitation of this vulnerability until an update can be applied.
You can find more information about DomPDF and its features on its official GitHub repository at https://github.com/dompdf/dompdf.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
