CVE-2021-3902

Description

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

Reserved 2021-10-24 | Published 2024-11-15 | Updated 2024-11-18 | Assigner @huntr_ai

Problem types

CWE-611 Improper Restriction of XML External Entity Reference

Product status

Any version before 2.0.0
affected

References

huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1

github.com/...ommit/f56bc8e40be6c0ae0825e6c7396f4db80620b799

cve.org (CVE-2021-3902)

nvd.nist.gov (CVE-2021-3902)

Download JSON