Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zdmpoLXhyaGYtdjl4aM4ABBYa

Improper Restriction of XML External Entity Reference in dompdf/dompdf

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Permalink: https://github.com/advisories/GHSA-3vjh-xrhf-v9xh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zdmpoLXhyaGYtdjl4aM4ABBYa
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 6 days ago
Updated: 2 days ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3vjh-xrhf-v9xh, CVE-2021-3902
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-3902
• https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
• https://huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
• https://github.com/advisories/GHSA-3vjh-xrhf-v9xh

Repository: https://github.com/dompdf/dompdf
Blast Radius: 42.6

Affected Packages