CVE-2023-23924
📋 TL;DR
Dompdf 2.0.1 has an SVG parsing vulnerability where URI validation can be bypassed using uppercase letters in <image> tags. This allows attackers to exploit PHP's phar wrapper for arbitrary unserialization on PHP < 8, leading to file deletion or remote code execution. Any system using dompdf 2.0.1 with PHP < 8.0.0 that processes SVG files is affected.
💻 Affected Systems
- dompdf
📦 What is this software?
Dompdf by Dompdf Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement.
Likely Case
Arbitrary file deletion and potential remote code execution if vulnerable classes are available.
If Mitigated
Limited impact if SVG uploads are restricted or PHP 8+ is used.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attack only requires SVG file upload capability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2
Vendor Advisory: https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
Restart Required: No
Instructions:
1. Update dompdf to version 2.0.2 or later via composer: composer require dompdf/dompdf:^2.0.2
2. Verify the update with: composer show dompdf/dompdf
3. Clear any cached files or restart PHP-FPM if applicable.
🔧 Temporary Workarounds
Disable SVG processing
allPrevent dompdf from processing SVG files entirely
Modify dompdf configuration to reject SVG input or implement file type validation before processing
Upgrade PHP to 8.0+
linuxPHP 8+ removes the phar unserialization vector
apt-get install php8.0
yum install php8.0
brew install php@8.0
🧯 If You Can't Patch
- Implement strict file upload validation to reject SVG files
- Use web application firewall rules to block SVG uploads to dompdf endpoints
🔍 How to Verify
Check if Vulnerable:
Check dompdf version: composer show dompdf/dompdf | grep version. If version is exactly 2.0.1 and PHP version is < 8.0.0, system is vulnerable.Check Version:
composer show dompdf/dompdf | grep versionVerify Fix Applied:
Confirm dompdf version is 2.0.2 or higher: composer show dompdf/dompdf | grep version📡 Detection & Monitoring
Log Indicators:
- Multiple failed SVG upload attempts
- Unusual file processing errors from dompdf
- PHP unserialization warnings in error logs
Network Indicators:
- HTTP POST requests with SVG files to PDF generation endpoints
- Unusual outbound connections following SVG uploads
SIEM Query:
source="web_logs" AND (uri="*pdf*" OR uri="*convert*") AND (file_extension="svg" OR content_type="image/svg+xml")🔗 References
- https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85
- https://github.com/dompdf/dompdf/releases/tag/v2.0.2
- https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
- https://github.com/dompdf/dompdf/commit/7558f07f693b2ac3266089f21051e6b78c6a0c85
- https://github.com/dompdf/dompdf/releases/tag/v2.0.2
- https://github.com/dompdf/dompdf/security/advisories/GHSA-3cw5-7cxw-v5qg
