CVE-2014-2383: DOMPDF Arbitrary File Read
Summary
CVE-2014-2383: DOMPDF Arbitrary File Read. Affects dompdf/dompdf versions >= 0.6.0, < 0.6.1. Fixed in 0.6.1. How to fix ↓
Also tracked for
- php-dompdf · Debian:11
The same CVE-2014-2383 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPDF is a PHP library that allows for the generation of PDF files from HTML content. It is commonly used in web applications to dynamically create and serve PDF documents. The vulnerability in question affects versions prior to 0.6.1 when the DOMPDF_ENABLE_PHP feature is enabled. This feature allows PHP code to be embedded within the HTML content, providing greater flexibility in generating PDFs. However, it also introduces a security risk that can be exploited by attackers to bypass chroot protections and read arbitrary files on the server.
Vulnerability Detail
The vulnerability arises from the handling of the input_file parameter in the dompdf.php script. By using a PHP protocol and wrappers, an attacker can craft a malicious value for the input_file parameter, such as php://filter/read=convert.base64-encode/resource, which instructs PHP to read the specified file and encode its contents in base64. This allows the attacker to read arbitrary files on the server, potentially exposing sensitive information. The impact of this vulnerability depends on the files that can be accessed and the sensitivity of their contents.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
composer require dompdf/dompdf:0.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the DOMPDF_ENABLE_PHP feature. This can be done by modifying the configuration of the DOMPDF library or the application that uses it. By disabling this feature, the vulnerability is effectively mitigated, but it may limit the flexibility of PDF generation if PHP code is required within the HTML content.
Conclusion
The DOMPDF Arbitrary File Read vulnerability (CVE-2014-2383) allows attackers to bypass chroot protections and read arbitrary files on the server. Upgrading to version 0.6.1 or later of the dompdf/dompdf package is recommended to fix this vulnerability. If immediate upgrade is not feasible, disabling the DOMPDF_ENABLE_PHP feature can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
DOMPDF is a PHP library for generating PDF files from HTML content. It is commonly used in web applications to dynamically create and serve PDF documents.
This vulnerability allows an attacker to bypass chroot protections and read arbitrary files on the server. The impact depends on the files that can be accessed and their sensitivity.
To fix this vulnerability, upgrade to version 0.6.1 or later of the dompdf/dompdf package.
Yes, you can disable the DOMPDF_ENABLE_PHP feature as a temporary workaround. This can be done by modifying the configuration of the DOMPDF library or the application that uses it.
There are known exploits for this vulnerability that allow attackers to read arbitrary files on the server. It is important to patch the vulnerability as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
