CVE-2021-3838: Deserialization of Untrusted Data in dompdf/dompdf
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.89473%
CWE
Published
11/15/2024
Updated
11/18/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompdf/dompdf | composer | < 2.0.0 | 2.0.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper protocol validation before passing user-controlled URIs to file_get_contents. Key functions identified:
- Stylesheet::load_css_file handled CSS @imports/resource loading with direct file_get_contents usage
- Dompdf::loadHtmlFile processed base document loading with similar pattern
- Helpers::getFileContent was the common file retrieval method used by both All three functions lacked proper protocol validation (phar:// filtering) in vulnerable versions, as shown by:
- Removal of hardcoded protocol lists in Dompdf.php
- Introduction of Options-based protocol validation in the patch
- Modified URI building logic in Helpers.php to prevent phar:// exploitation These functions directly interact with user-controlled URI inputs and PHP's file operations, making them critical points for deserialization attacks.