CVE-2023-24813
📋 TL;DR
CVE-2023-24813 is a critical vulnerability in Dompdf's SVG parsing that allows attackers to bypass URL restrictions and call arbitrary URLs with arbitrary protocols. When processing malicious SVG files, this can lead to arbitrary unserialization in PHP versions before 8.0.0, resulting in arbitrary file deletion or remote code execution. All Dompdf users processing untrusted SVG content are affected.
💻 Affected Systems
- Dompdf
📦 What is this software?
Dompdf by Dompdf Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Arbitrary file deletion and potential remote code execution depending on PHP version and available classes.
If Mitigated
Limited impact with proper input validation and file processing restrictions, but still potential for information disclosure via URL calls.
🎯 Exploit Status
Exploitation requires an attacker to provide a malicious SVG file to Dompdf. The vulnerability is well-documented in public advisories with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3
Vendor Advisory: https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75
Restart Required: No
Instructions:
1. Update Dompdf to version 2.0.3 or later using composer: 'composer require dompdf/dompdf:^2.0.3'. 2. Verify the update completed successfully. 3. Test PDF generation functionality to ensure compatibility.
🔧 Temporary Workarounds
Disable SVG processing
allTemporarily disable SVG file processing in Dompdf configuration to prevent exploitation.
Modify Dompdf configuration to set 'enable_remote' to false and disable SVG parsing
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize SVG files containing href or xlink:href attributes.
- Deploy network segmentation and web application firewalls to monitor and block suspicious file uploads and outbound connections.
🔍 How to Verify
Check if Vulnerable:
Check your composer.json or installed packages for Dompdf version. If version is below 2.0.3 and you process SVG files, you are vulnerable.Check Version:
composer show dompdf/dompdf | grep versionsVerify Fix Applied:
After updating, verify the installed version is 2.0.3 or higher using 'composer show dompdf/dompdf'.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections from web server, unexpected file deletion events, abnormal SVG file uploads
Network Indicators:
- HTTP requests to unusual external domains from web server, unexpected protocol usage in outbound connections
SIEM Query:
source="web_server" AND (event="file_deletion" OR event="svg_upload") AND process="php"🔗 References
- https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa
- https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75
- https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa
- https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75
