CVE-2021-3838: Deserialization of Untrusted Data in dompdf/dompdf
DomPDF before version 2.0.0 is vulnerable to PHAR (PHP Archive) deserialization due to a lack of checking on the protocol before passing it into the filegetcontents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects.
Published Nov 15, 2024 · Updated Nov 18, 2024
Affected packages
dompdf/dompdf
- Ecosystem
- Composer (PHP)
- Affected
- < 2.0.0
- Fixed in
- 2.0.0
- Check
composer show dompdf/dompdf
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
DomPDF before version 2.0.0 is vulnerable to PHAR (PHP Archive) deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology