CVE-2023-24813: Dompdf SVG Parsing URI Validation Failure
Summary
CVE-2023-24813: URI validation failure on SVG parsing. Bypass of CVE-2023-23924. Affects dompdf/dompdf versions >= 2.0.2, < 2.0.3. Fixed in 2.0.3. How to fix ↓
Also tracked for
- php-dompdf · Debian:12
The same CVE-2023-24813 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dompdf is a PHP library that allows for the generation of PDF files from HTML content. It is commonly used in web applications to convert HTML pages into PDF documents. The library provides functionality to parse SVG files and render them within the generated PDF. However, a vulnerability has been discovered in the URI validation process of SVG parsing, which can lead to arbitrary URL calls with arbitrary protocols.
Vulnerability Detail
The vulnerability arises due to a difference in the attribute parser between Dompdf and php-svg-lib. While Dompdf respects both the xlink:href and href attributes of image tags, php-svg-lib only considers the href attribute if both are specified. This inconsistency allows an attacker to bypass the URI validation protection by providing an empty xlink:href attribute. By exploiting this vulnerability, an attacker can call arbitrary URLs with arbitrary protocols, potentially leading to arbitrary file deletion and even remote code execution.
How To Fix
Minimum fixed version
2.0.3
This is the first release that contains the fix.
composer require dompdf/dompdf:2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually modify the Dompdf source code to enforce consistent handling of the xlink:href and href attributes. This can be done by modifying the src/Image/Cache.php file in the Dompdf library to always prioritize the href attribute over xlink:href when parsing image tags.
Conclusion
The vulnerability in Dompdf's SVG parsing URI validation can be exploited to call arbitrary URLs with arbitrary protocols, potentially leading to severe consequences. It is crucial to update the Dompdf library to version 2.0.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
Dompdf is a PHP library used for generating PDF files from HTML content. It is commonly used in web applications to convert HTML pages into PDF documents.
The vulnerability allows an attacker to call arbitrary URLs with arbitrary protocols, potentially leading to arbitrary file deletion and remote code execution.
To fix this vulnerability, update the Dompdf library to version 2.0.3 or later.
Yes, a temporary workaround involves modifying the Dompdf source code to enforce consistent handling of the xlink:href and href attributes.
For more information, you can visit the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
