Vulnerability · Published Apr 3, 2022 · Assigned by mitre
CVE-2022-28368
Critical 9.8
In plain English
A critical-severity security flaw in the dompdf/dompdf package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 83.9% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)83.9%top 0.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Metasploit, Public PoC
Official description
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | dompdf/dompdf | 1.2.1 | GHSA-x752-qjv4-c4hc |
Affected products (as reported)
References
- https://github.com/dompdf/dompdf/issues/2598
- https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
- https://github.com/snyk-labs/php-goof
- https://packagist.org/packages/dompdf/dompdf#v1.2.1
- https://github.com/dompdf/dompdf/pull/2808
- https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
- http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html