CVE-2021-3838·PHP vulnerability
DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution, especially when DOMPdf is used with frameworks with documented POP chains like Laravel or vulnerable developer code.
- Severity
- critical
- Software
- PHP
- Fixed in
- 2.0.0
- Published
- 2024-11-15
Affected versions
Until: 2.0.0
Fixed in: 2.0.0
How to fix this CVE
Update DomPDF to version 2.0.0 or later to patch the PHAR deserialization vulnerability. This fix adds protocol validation before file operations, preventing attackers from leveraging the phar:// protocol to instantiate arbitrary PHP objects. If your application depends on DomPDF through Composer, run `composer update dompdf/dompdf` to pull the patched version.
sudo dnf update php php-cli php-common php-fpmDefensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST requests to file upload or document rendering endpoints with phar:// protocol strings in file path parameters or multipart form fields; alternatively, access logs containing error patterns such as 'phar://' in query strings or file parameters followed by PHP deserialization warningsWAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Block HTTP requests containing the string 'phar://' in request parameters, POST body data, or file upload names. Implement strict input validation to reject any file protocol prefixes (phar://, php://, data://) in user-submitted file paths before they reach DomPDF processing functions.How to check if you are affected
- Check the installed DomPDF version with: `composer show dompdf/dompdf | grep versions` or examine vendor/dompdf/dompdf/composer.json
- Identify endpoints that accept file uploads and pass them to DomPDF's HTML-to-PDF rendering functions
- Search application logs and web server logs for requests containing `phar://` protocol patterns in file parameters or upload handling paths
- Verify the patch by confirming DomPDF version is 2.0.0+ with `composer show dompdf/dompdf` and reviewing that protocol validation is enforced in file loading code
FAQ
What is CVE-2021-3838?
CVE-2021-3838 is a critical PHP object injection vulnerability in DomPDF that allows remote code execution through PHAR deserialization. Attackers exploit missing protocol validation in file handling to execute arbitrary code via uploaded files.
Is CVE-2021-3838 being actively exploited?
According to CISA, CVE-2021-3838 is not listed as actively exploited in the wild, and no public exploits are widely available. However, the attack is trivial to execute if a file upload endpoint is misconfigured to pass user input to DomPDF.
What versions of DomPDF are affected by CVE-2021-3838?
All versions of DomPDF before 2.0.0 are vulnerable. Version 2.0.0 and later contain the fix that validates file protocols before processing.
How do I check if my server is vulnerable to CVE-2021-3838?
Run `composer show dompdf/dompdf` to display the installed version; if it is below 2.0.0, your environment is vulnerable. Additionally, check if your application allows file uploads that are passed to DomPDF rendering functions without sanitization.
Does Defensia detect CVE-2021-3838?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If DomPDF is installed on a monitored server and the version is below 2.0.0, CVE-2021-3838 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2021-3838. Free for 1 server.
Get started free