published April 3, 2022
NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.
⚠️ A crafty CSS statement could lead to remote code execution! This vulnerability in Dompdf 1.2.1 allows an attacker to exploit the `src:url` field of an `@font-face` rule—yikes! Think of it like a restaurant that allows diners to submit their own menu items without any checks. If they order a dish that includes a mystery ingredient, it could send the kitchen—and everyone eating there—into chaos! An attacker could potentially run any code they wish on the server, leading to unauthorized access, data manipulation, or even complete takeover of the system. This could spell disaster for any application relying on Dompdf for PDF generation, especially if sensitive information is involved.
Think of it like a restaurant that allows diners to submit their own menu items without any checks. If they order a dish that includes a mystery ingredient, it could send the kitchen—and everyone eating there—into chaos! This vulnerability allows attackers to inject malicious PHP code via the `src:url` attribute in the `@font-face` CSS declaration within an HTML input file, ultimately enabling remote code execution on the server.
An attacker could potentially run any code they wish on the server, leading to unauthorized access, data manipulation, or even complete takeover of the system. This could spell disaster for any application relying on Dompdf for PDF generation, especially if sensitive information is involved. To protect yourself, update Dompdf to the latest version immediately. Additionally, validate and sanitize any user inputs that could include CSS declarations to prevent unintended executions. Regular audits of your code can also catch these sneaky vulnerabilities! You've got this! With a quick update and some vigilance, you can keep your applications safe and sound! 🛡️