CVE-2014-2383: Infoleak
Arbitrary file read in dompdf
Other sources
dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the inputfile parameter.
— GitHub
dompdf.php in dompdf before 0.6.1, when DOMPDFENABLEPHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the inputfile parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the inputfile parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/dompdf/dompdfto a version that resolves this vulnerability.Fixed in 0.6.1 - Upgrade
Upgrade
dompdfto a version that resolves this vulnerability.Fixed in 0.6.1 - Configuration
Disable DOMPDF_ENABLE_PHP to prevent attackers from using PHP protocol and wrappers in the input_file parameter (e.g., php://filter/read=convert.base64-encode/resource) to bypass chroot protections and read arbitrary files.
dompdf.php DOMPDF_ENABLE_PHP = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2383?
CVE-2014-2383 is classified as a medium severity vulnerability due to its potential for arbitrary file read access.
How do I fix CVE-2014-2383?
To fix CVE-2014-2383, upgrade to dompdf version 0.6.1 or later.
What causes the vulnerability in CVE-2014-2383?
CVE-2014-2383 is caused by an issue in dompdf where enabling DOMPDF_ENABLE_PHP allows the use of PHP input wrappers to bypass security protections.
Is my system affected by CVE-2014-2383?
If you are using dompdf versions prior to 0.6.1 with DOMPDF_ENABLE_PHP enabled, your system is at risk from CVE-2014-2383.
What are the potential impacts of CVE-2014-2383?
The potential impacts of CVE-2014-2383 include unauthorized access to sensitive files on the system, leading to data breaches.