CVE-2022-41343: Dompdf Remote File Inclusion Vulnerability
Summary
CVE-2022-41343: Dompdf allows remote file inclusion because URI validation failure does not halt font registration. Affects dompdf/dompdf versions < 2.0.1. Fixed in 2.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Dompdf is a PHP library that allows users to generate PDF documents from HTML content. It is commonly used in web applications to convert web pages into printable PDF files. Dompdf provides various features and functionalities for styling and formatting PDF documents. However, a vulnerability has been discovered in versions prior to 2.0.1 that allows remote file inclusion.
Vulnerability Detail
The vulnerability, identified as CVE-2022-41343, exists in the registerFont function in FontMetrics.php of Dompdf. This function is responsible for registering fonts used in PDF generation. Due to a failure in URI validation, an attacker can exploit this vulnerability to include remote files. By crafting a malicious @font-face rule, an attacker can execute arbitrary code or inject malicious content into the generated PDF document. This can lead to various security risks, including remote code execution, information disclosure, and unauthorized access to sensitive data.
How To Fix
Minimum fixed version
2.0.1
This is the first release that contains the fix.
composer require dompdf/dompdf:2.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional input validation and sanitization measures to mitigate the risk of remote file inclusion. This can include validating and filtering user-supplied input, such as font filenames, to ensure they adhere to expected patterns and do not contain malicious content. Additionally, implementing a whitelist approach for allowed fonts can limit the potential impact of the vulnerability. However, applying the official fix by upgrading to the latest version is strongly recommended.
Conclusion
The CVE-2022-41343 vulnerability in Dompdf allows remote file inclusion, posing significant security risks. Users are advised to upgrade to Dompdf version 2.0.1 or later to fix this vulnerability. Implementing additional input validation and sanitization measures can serve as a temporary workaround. For more information and support, please contact DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
Dompdf is a PHP library used for generating PDF documents from HTML content. It is commonly used in web applications to convert web pages into printable PDF files.
The vulnerability allows remote file inclusion, which can lead to various security risks, including remote code execution, information disclosure, and unauthorized access to sensitive data.
To fix this vulnerability, it is recommended to upgrade to Dompdf version 2.0.1 or later. This includes proper URI validation during font registration to prevent remote file inclusion attacks.
As a temporary workaround, users can implement additional input validation and sanitization measures to mitigate the risk of remote file inclusion. However, applying the official fix by upgrading to the latest version is strongly recommended.
For more information about this vulnerability, you can refer to the official advisory provided by the GitHub Advisory Database. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
