GHSA-97m3-52wr-xvv2: Dompdf's usage of vulnerable version of phenx/php-svg-lib leads to restriction bypass and potential RCE

Should you act?

• Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with composer audit.
• No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

Details

Summary A lack of sanitization/check in the font path returned by php-svg-lib, in the case of a inline CSS font defined, that will be used by Cpdf to open a font will be passed to a fileexists call, which is sufficient to trigger metadata unserializing on a PHAR file, through the phar:// URL handler on PHP

Details The problem lies on the openFont function of the lib/Cpdf.php library, when the $font variable passed by php-svg-lib isn't checked correctly. A path is crafted through $name and $dir, which are two values that can be controlled through CSS :

Passing a font named phar:///foo/bar/baz.phar/test will set the value of $name to test and $dir to phar:///foo/bar/baz.phar, which once reconstructed will call fileexists on phar:///foo/bar/baz.phar/test.ufm. That allows to deserialize the baz.phar arbitrary file that contains a test.ufm file in the archive.

PoC

Consider the following, minimal PHP code :

With payload being this html file :

with the base64 image being :

A connection on ftp://blakl.is:21/ will occur, bypassing the allowed protocols.

CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Sources and references

1. GitHub Advisory GHSA-97m3-52wr-xvv2 github.com
2. github.com github.com
3. github.com github.com
4. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest