logo

Database

Enabled default configuration In dompdf/dompdf

Description

DOMPDF Arbitrary File Read dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2014-23832. NVD-2014-23833. OSV-2014-23834. OSV-DEBIAN-2014-23835. GCVE-2014-23836. SECURITY-TRACKER-CVE-2014-2383

References

1. https://github.com/dompdf/dompdf/commit/23a693993299e669306929e3d49a4a1f7b3fb0282. https://github.com/FriendsOfPHP/security-advisories/blob/master/dompdf/dompdf/CVE-2014-2383.yaml3. https://web.archive.org/web/20151215023329/http://www.securityfocus.com/archive/1/531912/100/0/threaded4. http://seclists.org/fulldisclosure/2014/Apr/2585. https://vulncheck.com/cve/CVE-2014-23836. https://www.exploit-db.com/exploits/330047. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-2383.yaml8. https://github.com/Relativ3Pa1n/CVE-2014-2383-LFI-to-RCE-Escalation

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.