dompdf php-svg-lib up to 0.5.1 parseCssStyle file inclusion

Summaryinfo

A vulnerability identified as problematic has been detected in dompdf php-svg-lib up to 0.5.1. This impacts the function Style::fromAttributes/Style::parseCssStyle. The manipulation leads to file inclusion. This vulnerability is uniquely identified as CVE-2024-25117. Local access is required to approach this attack. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in dompdf php-svg-lib up to 0.5.1 (Programming Language Software) and classified as problematic. This issue affects the function Style::fromAttributes/Style::parseCssStyle. The manipulation with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue.

The weakness was disclosed 02/21/2024. The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-25117 since 02/05/2024. Technical details are known, but no exploit is available.

Upgrading to version 0.5.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• dompdf

Name

• php-svg-lib

Version

• 0.5.0
• 0.5.1

License

• open-source

Website

• Product: https://github.com/dompdf/php-svg-lib/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion