CVE-2022-0085 Server-Side Request Forgery (SSRF) in dompdf/dompdf
An attacker can exploit a Server-Side Request Forgery vulnerability in the dompdf library to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0085?
CVE-2022-0085 is a low-severity server-side request forgery vulnerability in dompdf/dompdf, published on 28 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
Weakness: CWE-918
Which versions are affected by CVE-2022-0085?
2 open source packages ship an affected version, including dompdf/dompdf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompdf/dompdf Packagist | All versions | 2.0.0 |
dompdf/dompdf Packagist | All versions | 2.0.0 |
Products include Dompdf Project Dompdf.
How do I fix CVE-2022-0085?
Upgrade dompdf/dompdf to 2.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-0085 being exploited?
There is no known exploitation of CVE-2022-0085 in the wild and no public exploit code.
Other vulnerabilities in dompdf/dompdf
- CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924
- CVE-2023-23924 URI validation failure on SVG parsing in Dompdf
- CVE-2021-3838 PHAR Deserialization in dompdf/dompdf
- CVE-2021-3902 Improper Restriction of XML External Entity Reference in dompdf/dompdf
- CVE-2022-28368 Remote code injection in dompdf/dompdf
Sources
Also known as GHSA-pf6p-25r2-fx45.