CVE-2023-23924
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
- EPSS probability
- 51.46%
- CWE
- CWE-551
- Published
- 2023-01-31
- Last modified
- 2026-03-13
Affected products
- dompdf dompdf
Weakness type
Related vulnerabilities
- CVE-2021-34429 — For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characte
- CVE-2021-28164 — In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contai
- CVE-2021-28165 — In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon re
- CVE-2016-20030 — ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction
- CVE-2023-6394 — Quarkus: graphql operations over websockets bypass
- CVE-2021-31384 — Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service
- CVE-2021-32779 — Incorrectly handling of URI '#fragment' element as part of the path element
- CVE-2021-32777 — Incorrect concatenation of multiple value request headers in ext-authz extension