CVE-2021-3902: dompdf/dompdf SVG Parser XXE Vulnerability Leading to SSRF and Deserialization Attacks
Summary
CVE-2021-3902: Improper Restriction of XML External Entity Reference in dompdf/dompdf. Affects dompdf/dompdf versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Also tracked for
- php-dompdf · Debian:12
The same CVE-2021-3902 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dompdf is a popular PHP library that enables the generation of PDF documents from HTML and CSS. It is widely used in web applications for creating dynamic PDF files. The library supports various features such as image rendering, font embedding, and SVG parsing. However, an improper restriction of XML External Entity (XXE) references in its SVG parser has introduced a critical vulnerability that affects all versions prior to 2.0.0. This vulnerability can be exploited even when the isRemoteEnabled option is set to false, making it particularly concerning for developers relying on this library for secure document generation.
Vulnerability Detail
The vulnerability arises from the SVG parser's failure to adequately restrict external entity references, allowing attackers to perform Server-Side Request Forgery (SSRF) attacks. This can lead to the disclosure of internal image files and potential PHAR deserialization attacks. The technical implications include the ability for an attacker to manipulate XML input to access sensitive internal resources, which could compromise the security of the application and its data.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require dompdf/dompdf:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider disabling the SVG parser or sanitizing SVG inputs to prevent the inclusion of external entities. Additionally, review your application’s XML handling to ensure that external entity references are not processed.
Conclusion
The CVE-2021-3902 vulnerability in the dompdf library poses significant security risks due to improper handling of XML External Entity references. It is crucial for developers using this library to update to version 2.0.0 or later to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for dompdf/dompdf →
FAQ
CVE-2021-3902 is a critical vulnerability in the dompdf library that allows for improper restriction of XML External Entity references, leading to potential SSRF and deserialization attacks.
All versions of dompdf prior to 2.0.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to internal resources, disclosure of sensitive information, and potential compromise of the application.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
