CVE-2014-5013: DOMPDF Remote Code Execution
Summary
CVE-2014-5013: DOMPDF Remote Code Execution. Affects dompdf/dompdf versions >= 0.6, < 0.6.2. Fixed in 0.6.2. How to fix ↓
Also tracked for
- php-dompdf · Debian:11
The same CVE-2014-5013 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPDF is a PHP library that allows users to generate PDF files from HTML content. It is commonly used in web applications to dynamically generate PDF documents. The library provides various features for styling and formatting the PDF output. However, versions before 0.6.2 are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability in DOMPDF (CVE-2014-5013) allows remote attackers to execute arbitrary code on the server. This vulnerability is related to CVE-2014-2383. An attacker can exploit this vulnerability by injecting malicious code into the HTML content that is processed by DOMPDF. When the PDF is generated, the malicious code is executed on the server, leading to potential compromise of the system. This vulnerability has a moderate severity rating according to the Common Vulnerability Scoring System (CVSS).
How To Fix
Minimum fixed version
0.6.2
This is the first release that contains the fix.
composer require dompdf/dompdf:0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to sanitize the HTML content before passing it to DOMPDF. This can be done by using a HTML sanitizer library or by implementing custom sanitization logic. The goal is to remove any potentially malicious code from the HTML content to prevent code execution.
Conclusion
The CVE-2014-5013 vulnerability in DOMPDF allows remote code execution, posing a significant risk to applications using vulnerable versions of the library. It is crucial to upgrade to the latest version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for dompdf/dompdf →
FAQ
DOMPDF is a PHP library for generating PDF files from HTML content.
The vulnerability allows remote code execution, which can lead to unauthorized access, data breaches, and potential compromise of the server.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including CVE-2014-5013.
Yes, upgrading to DOMPDF version 0.6.2 or later will fix this vulnerability.
If upgrading is not possible, you can sanitize the HTML content before passing it to DOMPDF to mitigate the risk of code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompdf/dompdf.
