Researchers have disclosed an unpatched security vulnerability in “dompdf,” a PHP-based HTML to PDF converter, that, if successfully exploited, could lead to remote code execution in certain configurations.
“By injecting CSS into the data processed by dompdf, it can be tricked into storing a malicious font with a .php file extension in its font cache, which can later be executed by accessing it from the web,” Positive Security researchers Maximilian Kirchmeier and Fabian Bräunlein said in a report published today.
In other words, the flaw allows a malicious party to upload font files with a .php extension to the web server, which can then be activated by using an XSS vulnerability to inject HTML into a web page before it’s rendered as a PDF.
images from Hacker News
Recent Comments