CVE Feed

    Dashboard / CVE / CVE-2022-28368

    CVE-2022-28368

    Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

    Published:Apr 3, 2022
    Last Modified:Nov 21, 2024
    EPS:Apr 3, 2022
    EPSS Score:0.70844
    CVSS Score:9.8

    Affected Products

    Vendor
    Dompdf Project
    Product
    Dompdf

    Exploits

    https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/https://www.exploit-db.com/exploits/51270https://github.com/Henryisnotavailable/Dompdf-Exploit-RCEhttps://github.com/rvizx/CVE-2022-28368https://github.com/rvzsec/CVE-2022-28368https://github.com/That-Guy-Steve/CVE-2022-28368-handler

    Related CVEs

    CVE-2021-3902 (CVSS 9.8) — An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Serv…
    CVE-2021-3838 (CVSS 9.8) — DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol be…
    CVE-2023-50262 (CVSS 5.3) — Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to e…
    CVE-2023-24813 (CVSS 10) — Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
    CVE-2023-23924 (CVSS 10) — Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passi…
    CVE-2022-41343 (CVSS 7.5) — registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation f…
    CVE-2022-2400 (CVSS 5.3) — External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.…
    CVE-2022-0085 (CVSS 5.3) — Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.…
    CVE-2014-5011 (CVSS 6.5) — DOMPDF before 0.6.2 allows Information Disclosure.…
    CVE-2014-5012 (CVSS 6.5) — DOMPDF before 0.6.2 allows denial of service.…

    References

    http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
    https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
    https://github.com/dompdf/dompdf/issues/2598
    https://github.com/dompdf/dompdf/pull/2808
    https://github.com/snyk-labs/php-goof
    https://packagist.org/packages/dompdf/dompdf#v1.2.1
    https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
    http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
    https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
    https://github.com/dompdf/dompdf/issues/2598
    https://github.com/dompdf/dompdf/pull/2808
    https://github.com/snyk-labs/php-goof
    https://packagist.org/packages/dompdf/dompdf#v1.2.1
    https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High