ghsa-56gj-mvh6-rp75
Vulnerability from github
Summary
Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols.
Details
Dompdf parses the href attribute of image tags with the following code:
src/Image/Cache.php line 135-150
php
function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
if (strtolower($name) === "image") {
$attributes = array_change_key_case($attributes, CASE_LOWER);
$url = $attributes["xlink:href"] ?? $attributes["href"];
if (!empty($url)) {
$inner_full_url = Helpers::build_url($parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $url);
if ($inner_full_url === $full_url) {
throw new ImageException("SVG self-reference is not allowed", E_WARNING);
}
[$resolved_url, $type, $message] = self::resolve_url($url, $parsed_url["protocol"], $parsed_url["host"], $parsed_url["path"], $options);
if (!empty($message)) {
throw new ImageException("This SVG document references a restricted resource. $message", E_WARNING);
}
}
}
},
As you can see from the code snippet above, it respects xlink:href even if href is specified.
php
$url = $attributes["xlink:href"] ?? $attributes["href"];
However, php-svg-lib, which is later used to parse the svg file, parses the href attribute with the following code:
src/Svg/Tag/Image.php line 51-57
``` php
if (isset($attributes['xlink:href'])) {
$this->href = $attributes['xlink:href'];
}
if (isset($attributes['href'])) { $this->href = $attributes['href']; } ```
Since href is respected if both xlink:href and href is specified, it's possible to bypass the protection on the Dompdf side by providing an empty xlink:href attribute.
Impact
An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dompdf/dompdf"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.2"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.2"
]
}
],
"aliases": [
"CVE-2023-24813"
],
"database_specific": {
"cwe_ids": [
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-07T18:16:23Z",
"nvd_published_at": "2023-02-07T19:15:00Z",
"severity": "CRITICAL"
},
"details": "### Summary\nDue to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols.\n\n### Details\nDompdf parses the href attribute of `image` tags with the following code:\n\n[`src/Image/Cache.php` line 135-150](https://github.com/dompdf/dompdf/blob/2a8a6b80fcaa5148ace50f35a10979fe00c6a35d/src/Image/Cache.php#L135-L150)\n``` php\nfunction ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {\n if (strtolower($name) === \"image\") {\n $attributes = array_change_key_case($attributes, CASE_LOWER);\n $url = $attributes[\"xlink:href\"] ?? $attributes[\"href\"];\n if (!empty($url)) {\n $inner_full_url = Helpers::build_url($parsed_url[\"protocol\"], $parsed_url[\"host\"], $parsed_url[\"path\"], $url);\n if ($inner_full_url === $full_url) {\n throw new ImageException(\"SVG self-reference is not allowed\", E_WARNING);\n }\n [$resolved_url, $type, $message] = self::resolve_url($url, $parsed_url[\"protocol\"], $parsed_url[\"host\"], $parsed_url[\"path\"], $options);\n if (!empty($message)) {\n throw new ImageException(\"This SVG document references a restricted resource. $message\", E_WARNING);\n }\n }\n }\n},\n```\n\nAs you can see from the code snippet above, it respects `xlink:href` even if `href` is specified.\n``` php\n$url = $attributes[\"xlink:href\"] ?? $attributes[\"href\"];\n```\n\nHowever, php-svg-lib, which is later used to parse the svg file, parses the href attribute with the following code:\n\n[`src/Svg/Tag/Image.php` line 51-57](https://github.com/dompdf/php-svg-lib/blob/76876c6cf3080bcb6f249d7d59705108166a6685/src/Svg/Tag/Image.php#L51-L57)\n``` php\nif (isset($attributes[\u0027xlink:href\u0027])) {\n $this-\u003ehref = $attributes[\u0027xlink:href\u0027];\n}\n\nif (isset($attributes[\u0027href\u0027])) {\n $this-\u003ehref = $attributes[\u0027href\u0027];\n}\n```\n\nSince `href` is respected if both `xlink:href` and `href` is specified, it\u0027s possible to bypass the protection on the Dompdf side by providing an empty `xlink:href` attribute.\n\n### Impact\nAn attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes.",
"id": "GHSA-56gj-mvh6-rp75",
"modified": "2023-02-08T16:18:55Z",
"published": "2023-02-07T18:16:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dompdf/dompdf/security/advisories/GHSA-56gj-mvh6-rp75"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24813"
},
{
"type": "WEB",
"url": "https://github.com/dompdf/dompdf/commit/95009ea98230f9b084b040c34e3869ef3dccc9aa"
},
{
"type": "PACKAGE",
"url": "https://github.com/dompdf/dompdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "URI validation failure on SVG parsing. Bypass of CVE-2023-23924"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.