CVE-2021-3838: dompdf/dompdf Critical PHAR Deserialization Vulnerability
Summary
CVE-2021-3838: Deserialization of Untrusted Data in dompdf/dompdf. Affects dompdf/dompdf versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Also tracked for
- php-dompdf · Debian:11
The same CVE-2021-3838 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DomPDF is a popular PHP library used for generating PDF documents from HTML. It is widely utilized in various web applications due to its ease of use and flexibility. However, prior to version 2.0.0, DomPDF had a critical vulnerability that allowed for PHAR (PHP Archive) deserialization, which could be exploited by attackers to execute arbitrary PHP code on the server.
Vulnerability Detail
The vulnerability arises from a lack of validation on the protocol used in file_get_contents() function calls. An attacker with the ability to upload files can exploit this by uploading a malicious PHAR file. When this file is processed by DomPDF, it can lead to the instantiation of arbitrary PHP objects, potentially resulting in remote code execution. This is particularly dangerous when DomPDF is integrated with frameworks like Laravel, which may have documented object injection chains.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require dompdf/dompdf:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads to only allow specific file types and implement strict validation on uploaded files to prevent the upload of PHAR files. Additionally, consider disabling any features that allow for file inclusion or deserialization until the package is updated.
Conclusion
The PHAR deserialization vulnerability in DomPDF prior to version 2.0.0 poses a significant risk, allowing for potential remote code execution. It is crucial for developers using this library to update to the latest version and implement security best practices to mitigate risks.
See every vulnerability recorded for dompdf/dompdf →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary PHP code on the server, which can compromise the entire application.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
If you cannot update the package immediately, implement strict file upload validations and consider disabling features that could be exploited until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
