CVE-2022-28368
📋 TL;DR
CVE-2022-28368 is a critical remote code execution vulnerability in Dompdf, a PHP library for generating PDFs from HTML. Attackers can exploit this by embedding malicious CSS @font-face rules with PHP file references in HTML input, allowing arbitrary code execution on the server. Any application using Dompdf to process untrusted HTML input is affected.
💻 Affected Systems
- Dompdf
📦 What is this software?
Dompdf by Dompdf Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, website defacement, or cryptocurrency mining malware installation.
If Mitigated
Limited impact if Dompdf only processes trusted HTML sources or runs in sandboxed environments.
🎯 Exploit Status
Public exploit code available on Packet Storm and GitHub. Exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.2 and later
Vendor Advisory: https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
Restart Required: No
Instructions:
1. Update Dompdf to version 1.2.2 or later via Composer: composer require dompdf/dompdf:^1.2.2
2. Clear Composer cache: composer clearcache
3. Test PDF generation functionality.
🔧 Temporary Workarounds
Input sanitization
allSanitize HTML input to remove or validate @font-face CSS rules before processing with Dompdf.
Restrict file protocol
allConfigure Dompdf to disallow file:// protocol in font URLs via Dompdf options.
$dompdf->set_option('isRemoteEnabled', false);
🧯 If You Can't Patch
- Disable Dompdf processing of untrusted HTML input entirely.
- Run Dompdf in a sandboxed container with minimal permissions and network access.
🔍 How to Verify
Check if Vulnerable:
Check if Dompdf version is below 1.2.2 by examining composer.json or vendor/dompdf/dompdf/VERSION file.Check Version:
php -r "require 'vendor/autoload.php'; echo \Dompdf\Dompdf::VERSION;"Verify Fix Applied:
Confirm Dompdf version is 1.2.2 or higher and test with known exploit payloads to ensure they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual PHP file execution in Dompdf temp directories
- HTTP requests with CSS @font-face containing .php extensions
Network Indicators:
- Outbound connections from web server to suspicious domains after PDF generation
SIEM Query:
source="web_logs" AND (uri="*.php" AND user_agent LIKE "%Dompdf%")🔗 References
- http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
- https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
- https://github.com/dompdf/dompdf/issues/2598
- https://github.com/dompdf/dompdf/pull/2808
- https://github.com/snyk-labs/php-goof
- https://packagist.org/packages/dompdf/dompdf#v1.2.1
- https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
- http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html
- https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d
- https://github.com/dompdf/dompdf/issues/2598
- https://github.com/dompdf/dompdf/pull/2808
- https://github.com/snyk-labs/php-goof
- https://packagist.org/packages/dompdf/dompdf#v1.2.1
- https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/
