CVE-2021-3902

The SVG parser in dompdf improperly restricts the processing of external XML entities (XXE), which allows embedding malicious references to external resources in an SVG document. An attacker can thus trigger SSRF requests to the server's internal infrastructure, disclose internal graphic files, and conduct a PHAR deserialization attack by providing an appropriately crafted file. Importantly, the vulnerability is active even when the isRemoteEnabled option is set to false, which contradicts the common belief in the effectiveness of this security measure.

An attacker can gain unauthorized access to internal network resources (SSRF), disclose sensitive files from the server, and perform a deserialization attack that potentially leads to server takeover (RCE).

The dompdf library should be updated to version 2.0.0 or later. Patch details are available in the vendor references at: https://github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799

All versions of the dompdf/dompdf library prior to 2.0.0