MediumGHSA-qr6q-w4gj-3865CVE-2014-2383
DOMPDF Arbitrary File Read
Published 14 May 2022 · Updated 8 Dec 2024
Affected package
dompdf/dompdfComposer
- Affected
- >=0.6.0 <0.6.1
- Fixed in
- 0.6.1
Update to the fixed version for your release line, for example:
composer require dompdf/dompdf:^0.6.1Details
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
Is GHSA-qr6q-w4gj-3865 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected dompdf/dompdf, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2014-2383
- Linkgithub.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb028
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2014-2383.yaml
- Packagegithub.com/dompdf/dompdf
- Linkweb.archive.org/web/20151215023329/http://www.securityfocus.com/archive/1/531912/100/0/threaded
- Linkseclists.org/fulldisclosure/2014/Apr/258
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.