CVE-2021-3902: Improper Restriction of XML External Entity Reference in dompdf/dompdf

November 15, 2024 (updated November 18, 2024)

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf’s SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attackers to perform SSRF, disclose internal image files, and cause PHAR deserialization attacks.

References

github.com/advisories/GHSA-3vjh-xrhf-v9xh
github.com/dompdf/dompdf
github.com/dompdf/dompdf/commit/f56bc8e40be6c0ae0825e6c7396f4db80620b799
huntr.com/bounties/a6071c07-806f-429a-8656-a4742e4191b1
nvd.nist.gov/vuln/detail/CVE-2021-3902

Detect and mitigate CVE-2021-3902 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →