CVE-2021-3838 PHAR Deserialization in dompdf/dompdf

What is CVE-2021-3838?

CVE-2021-3838 is a critical unsafe deserialization vulnerability in dompdf/dompdf, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.

Weakness: CWE-502

Which versions are affected by CVE-2021-3838?

2 open source packages ship an affected version, including dompdf/dompdf. It affects 1 product.

Products include Dompdf Project Dompdf.

How do I fix CVE-2021-3838?

Upgrade dompdf/dompdf to 2.0.0 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-3838 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-3838 exists.

Other vulnerabilities in dompdf/dompdf

• CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924 Critical 10.0
• CVE-2023-23924 URI validation failure on SVG parsing in Dompdf Critical 10.0
• CVE-2021-3902 Improper Restriction of XML External Entity Reference in dompdf/dompdf Critical 9.8
• CVE-2022-28368 Remote code injection in dompdf/dompdf Critical 9.8
• CVE-2014-5013 DOMPDF Remote Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-3838, DLA-3495-2, GHSA-577p-7j7h-2jgf, UBUNTU-CVE-2021-3838.