CVE-2022-28368 Remote code injection in dompdf/dompdf
Remote attackers can execute arbitrary code by uploading a PHP file referenced in a CSS font-face URL within an HTML input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-28368?
CVE-2022-28368 is a critical code injection vulnerability in n/a, published on 3 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Weakness: CWE-79
Which versions are affected by CVE-2022-28368?
2 open source packages ship an affected version, including dompdf/dompdf. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dompdf/dompdf Packagist | All versions | 1.2.1 |
dompdf/dompdf Packagist | All versions | 1.2.1 |
Products include Dompdf Project Dompdf.
How do I fix CVE-2022-28368?
Upgrade dompdf/dompdf to 1.2.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-28368 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-28368 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2023-24813 URI validation failure on SVG parsing. Bypass of CVE-2023-23924
- CVE-2023-23924 URI validation failure on SVG parsing in Dompdf
- CVE-2021-3838 PHAR Deserialization in dompdf/dompdf
- CVE-2021-3902 Improper Restriction of XML External Entity Reference in dompdf/dompdf
- CVE-2014-5013 DOMPDF Remote Code Execution
Sources
Also known as GHSA-x752-qjv4-c4hc.