Summary When parsing the attributes passed to a use tag inside an svg document, we can cause the system to go to an infinite recursion. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.

Details Inside Svg\Tag\UseTag::before, php-svg-lib parses the attributes passed to an use tag inside an svg document. When it finds a href or xlink:href, it will try to retrieve the object representing this tag:

$link = $attributes["href"] ?? $attributes["xlink:href"]; $this->reference = $document->getDef($link);

if ($this->reference) { $this->reference->before($attributes); }

$document->getDef is implemented as follow:

public function getDef($id) { $id = ltrim($id, "#");

return isset($this->defs[$id]) ? $this->defs[$id] : null; }

Note: the $id in the above method is actually the link being used in use tag. This part is important, because this behaviour here actually leads to the vulnerability. It will be mentioned later on in this report.

If it finds the referenced object, it will try to call the before method on the referenced object (this is still inside Svg\Tag\UseTag::before) :

if ($this->reference) { $this->reference->before($attributes); }

In order to cause an infinte loop, we need to be able to control the $id used in the $this->defs[$id] code above. This defs property (Svg\Document::defs) is being populated when Svg\Document::tagStart is called. This is the handler being used when the php-svg-lib is parsing the svg structure:

// Svg\Document line 343 if ($tag) { if (isset($attributes["id"])) { $this->defs[$attributes["id"]] = $tag; } else { // ... }

// ... }

So if the use tag contains an id, then that use tag will be added to the $defs array with it's id as the key.

Now as noted before, when there is a link inside the use tag, the library uses that link as the id to actually find the object or tag that has been added to the Svg\Document::defs.

So if the id attribute is equal to the link attribute inside the use tag, then the referenced object (in this case it is the Use tag object) will be called recursively until the memory given to the script is exhausted.

PoC

This is an example svg file that can be used to demonstrate the vulnerability.

<svg width="200" height="200" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <use id="selfref" xlink:href="#selfref" /> </svg>

Impact

When the lib parses the above payload, it will crash:

PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 262144 bytes) in /xxx/dompdf/vendor/phenx/php-svg-lib/src/Svg/Tag/UseTag.php on line 37

An attacker sending multiple request to a system to render the above payload can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.

Summary The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing <image> tags with uppercase letters. This might leads to arbitrary object unserialize on PHP < 8, through the phar URL wrapper.

Details The bug occurs during SVG parsing of <image> tags, in src/Image/Cache.php :

if ($type === "svg") { $parser = xmlparsercreate("utf-8"); xmlparsersetoption($parser, XMLOPTIONCASEFOLDING, false); xmlsetelementhandler( $parser, function ($parser, $name, $attributes) use ($options, $parsedurl, $fullurl) { if ($name === "image") { $attributes = arraychangekeycase($attributes, CASELOWER); This part will try to detect <image> tags in SVG, and will take the href to validate it against the protocolAllowed whitelist. However, the $name comparison with "image" is case sensitive, which means that such a tag in the SVG will pass :

<svg> <Image xlink:href="phar:///foo"></Image> </svg>

As the tag is named "Image" and not "image", it will not pass the condition to trigger the check.

A correct solution would be to strtolower the $name before the check :

if (strtolower($name) === "image") {

PoC Parsing the following SVG file is sufficient to reproduce the vulnerability :

<svg> <Image xlink:href="phar:///foo"></Image> </svg>

Impact An attacker might be able to exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will leads at the very least to an arbitrary file deletion, and might leads to remote code execution, depending on classes that are available.

Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Dompdf parses the href attribute of image tags and respects xlink:href even if href is specified. However, php-svg-lib, which is later used to parse the svg file, parses the href attribute. Since href is respected if both xlink:href and href is specified, it's possible to bypass the protection on the Dompdf side by providing an empty xlink:href attribute. An attacker can exploit the vulnerability to call arbitrary URLs with arbitrary protocols if they provide an SVG file to the Dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, which will lead, at the very least, to arbitrary file deletion and might lead to remote code execution, depending on available classes. This vulnerability has been addressed in commit 95009ea98 which has been included in release version 2.0.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

[Unknown description]

PHP remote file inclusion vulnerability in dompdf.php

Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.

Information Disclosure

Denial Of Service Vector

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling <use> tag that references an <image> tag, it merges the attributes from the <use> tag to the <image> tag. The problem pops up especially when the href attribute from the <use> tag has not been sanitized. This can lead to an unsafe file read that can cause PHAR Deserialization vulnerability in PHP prior to version 8. Version 0.5.1 contains a patch for this issue.

Summary When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, a recursive chained using two or more SVG documents is not correctly validated. Depending on the system configuration and attack pattern this could exhaust the memory available to the executing process and/or to the server itself.

Details php-svg-lib, when run in isolation, does not support SVG references for image elements. An SVG document can, however, be referenced and Dompdf will run that reference through the same validation. Dompdf currently includes validation to prevent self-referential image references, but a chained reference is not checked. A malicious actor may thus trigger infinite recursion in the validation process by chaining references between two or more SVG images.

PoC

This following sources can be used to bypass validation provided by Dompdf:

recurse.html <img src="one.svg">

one.svg <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg"> <image href="two.svg" /> </svg>

two.svg <svg width="200" height="200" xmlns="http://www.w3.org/2000/svg"> <image href="one.svg" /> </svg>

Impact

When Dompdf parses the above payload, it will crash due after exceeding the allowed execution time or memory usage. An attacker sending multiple request to a system can potentially cause resource exhaustion to the point that the system is unable to handle incoming request.