CVE-2021-3838

The application does not verify the protocol passed to the file_get_contents() function, which allows an attacker to substitute a URI with a phar:// prefix. If the attacker is able to upload a file of any type to the server (e.g., through an upload form), they can prepare a PHAR archive containing serialized PHP objects. Passing a phar:// path to the vulnerable function causes automatic deserialization of the archive metadata and instantiation of arbitrary PHP classes available in the application. Combined with existing POP (Property-Oriented Programming) chains, arbitrary code execution on the server side is possible.

An attacker can gain full control over the server through remote code execution (RCE), and can also compromise the confidentiality, integrity, and availability of data processed by the application.

DomPDF should be updated to version 2.0.0 or newer, which includes protocol verification before passing values to file_get_contents(). The fix is available in commit 99aeec1efec9213e87098d42eb09439e7ee0bb6a. Additionally, it is recommended to restrict file upload capabilities to authenticated and authorized users only, and to validate file extensions and MIME types of uploaded files.

DomPDF in versions before 2.0.0 (dompdf/dompdf project).