XXE Vulnerability in php-dompdf: SSRF and Deserialization Risks
Summary
CVE-2021-3902: An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. Affects php-dompdf across 2 version ranges.
< 2.0.2+dfsg-1
< f56bc8e40be6c0ae0825e6c7396f4db80620b799
Fixed in 2.0.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php-dompdf is a popular PHP library that converts HTML to PDF documents. It supports various features such as SVG rendering, font embedding, and image handling. However, the library has been found to have a vulnerability in its SVG parser that allows for improper handling of external entities, potentially exposing applications to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-3902, stems from an improper restriction of external entities (XXE) in the SVG parser of php-dompdf. This flaw allows attackers to exploit the library for Server-Side Request Forgery (SSRF) and deserialization attacks, even when the isRemoteEnabled option is set to false. The implications of this vulnerability include unauthorized access to internal image files and the potential for PHAR deserialization attacks, which can lead to remote code execution.
How To Fix
Minimum fixed version
2.0.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-dompdfTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the SVG parsing feature if it is not essential for your application. This can be done by avoiding the use of SVG files in your PDF generation process until the library is updated.
Conclusion
The CVE-2021-3902 vulnerability in php-dompdf poses significant security risks due to its potential for SSRF and deserialization attacks. It is crucial for developers using this library to update to the patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for php-dompdf →
FAQ
CVE-2021-3902 is a vulnerability in the php-dompdf library that allows for SSRF and deserialization attacks due to improper handling of external entities in its SVG parser.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to internal resources, potential data exposure, and the ability to execute arbitrary code through deserialization attacks.
Yes, the vulnerability has been patched in version 2.0.2 of php-dompdf. It is recommended to update to this version or higher.
If an immediate update is not possible, consider disabling SVG parsing in your application as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for php-dompdf.
