9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.3%
Dompdf is an HTML to PDF converter written in php. Due to the difference in
the attribute parser of Dompdf and php-svg-lib, an attacker can still call
arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute
of image
tags and respects xlink:href
even if href
is specified.
However, php-svg-lib, which is later used to parse the svg file, parses the
href attribute. Since href
is respected if both xlink:href
and href
is specified, it’s possible to bypass the protection on the Dompdf side by
providing an empty xlink:href
attribute. An attacker can exploit the
vulnerability to call arbitrary URLs with arbitrary protocols if they
provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads
to arbitrary unserialize, which will lead, at the very least, to arbitrary
file deletion and might lead to remote code execution, depending on
available classes. This vulnerability has been addressed in commit
95009ea98
which has been included in release version 2.0.3. Users are
advised to upgrade. There are no known workarounds for this vulnerability.
Author | Note |
---|---|
sbeattie | in Ubuntu versions src/Image/Cache.php is in ./include/image_cache.cls.php and does not contain the affected code. |
github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa
github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75
launchpad.net/bugs/cve/CVE-2023-24813
nvd.nist.gov/vuln/detail/CVE-2023-24813
security-tracker.debian.org/tracker/CVE-2023-24813
www.cve.org/CVERecord?id=CVE-2023-24813
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.3%