CVE-2022-0085: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0. DomPDF uses file_get_contents to obtain HTTP files when allow_url_fopen is On. In default contexts, file_get_contents will redirect whenever served with a 302 response. When developers use DomPDF with isRemoteEnabled set to true and allow_url_fopen set to true, but restrict IP addresses via a deny list, it is possible for an attacker to pass in a URL which passes this deny list but serves a 302 redirect response to a restricted IP address. When this URL enters dompdf, file_get_contents() will both follow the redirection and cause an SSRF vulnerability.