CriticalGHSA-577p-7j7h-2jgfCVE-2021-3838

Deserialization of Untrusted Data in dompdf/dompdf

Published 15 Nov 2024 · Updated 18 Nov 2024

Affected package

dompdf/dompdfComposer
Affected
<2.0.0
Fixed in
2.0.0
Update to the fixed version for your release line, for example:composer require dompdf/dompdf:^2.0.0

Details

DomPDF before version 2.0.0 is vulnerable to PHAR (PHP Archive) deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.

Is GHSA-577p-7j7h-2jgf in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected dompdf/dompdf, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.