CVE-2024-51058
📋 TL;DR
A Local File Inclusion (LFI) vulnerability in TCPDF 6.7.5 allows attackers to read arbitrary files from the server's file system through malicious <img> src tags in PDF generation. This can expose sensitive information like configuration files, credentials, or source code. Any application using the vulnerable TCPDF version for PDF generation is affected.
💻 Affected Systems
- TCPDF
📦 What is this software?
Tcpdf by Tcpdf Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure leading to credential theft, source code exposure, and potential lateral movement within the network.
Likely Case
Sensitive file disclosure including configuration files, environment variables, and application secrets.
If Mitigated
Limited file access restricted by server permissions and file path validation.
🎯 Exploit Status
Exploitation requires user input that gets processed through TCPDF's PDF generation with <img> tags. Public proof-of-concept available in GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit bfa7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b and later versions
Vendor Advisory: https://github.com/tecnickcom/TCPDF/commit/bfa7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b
Restart Required: No
Instructions:
1. Update TCPDF to latest version from GitHub. 2. Replace vulnerable TCPDF files with patched version. 3. Test PDF generation functionality.
🔧 Temporary Workarounds
Input Validation and Sanitization
allValidate and sanitize all user input before passing to TCPDF, especially <img> src attributes.
Disable Image File Inclusion
allConfigure TCPDF to disallow file:// protocol in image sources if not required.
🧯 If You Can't Patch
- Implement strict input validation to reject or sanitize file paths in <img> tags
- Use web application firewall (WAF) rules to block LFI patterns in PDF generation requests
🔍 How to Verify
Check if Vulnerable:
Check if TCPDF version is 6.7.5 and application processes user-controlled <img> tags in PDF generation.Check Version:
Check TCPDF version in TCPDF installation directory or composer.jsonVerify Fix Applied:
Test PDF generation with malicious <img> src="file:///etc/passwd" tags - should not disclose file contents.📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in PDF generation requests
- Multiple failed file inclusion attempts
- Large number of PDF generation requests with file:// URLs
Network Indicators:
- HTTP requests containing file:// paths in POST data or parameters
- Abnormal traffic patterns to PDF generation endpoints
SIEM Query:
source="web_logs" AND (uri="*generate_pdf*" OR uri="*pdf*" OR uri="*tcpdf*") AND (request_body="*file://*" OR params="*file://*")