DomPDF Vulnerability Allows for Remote Code Execution

CVE-2021-3838

What is CVE-2021-3838?

DomPDF versions prior to 2.0.0 exhibit a vulnerability allowing PHAR deserialization due to insufficient validation of the protocol in use before inputting it into the file_get_contents() function. This weakness enables attackers with the ability to upload files of any type to leverage the phar:// protocol, leading to the unserialization of uploaded files and the potential instantiation of arbitrary PHP objects. Such capabilities significantly elevate the risk of remote code execution, particularly when utilized alongside frameworks containing known PHP Object Injection (POP) chains, such as Laravel, or when they are integrated with poorly secured developer code. Organizations utilizing DomPDF should apply necessary security patches and adhere to best practices to mitigate this vulnerability.

References