Description
This module exploits CVE-2022-28368, a Remote Code Execution vulnerability in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf preserves the original file extension when caching fonts downloaded via CSS @font-face rules. By pointing a @font-face src to a .php file containing a valid TrueType font header with embedded PHP code, the file is saved in the dompdf font cache (lib/fonts/) with its .php extension intact. The cached file can then be executed by directly requesting it from the web server.
For dompdf versions <= 0.8.5, remote font loading works regardless of the $isRemoteEnabled setting. For versions 0.8.6 through 1.2.0, the $isRemoteEnabled option must be set to true.
This module requires the ability to inject HTML/CSS into the data processed by dompdf (e.g., via an XSS, a user-controlled form field, or a direct parameter) and that the dompdf font cache directory is web-accessible.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/dompdf/rce_cve_2022_28368msf undefined(rce_cve_2022_28368) > show actions ...actions...msf undefined(rce_cve_2022_28368) > set ACTION < action-name >msf undefined(rce_cve_2022_28368) > show options ...show and set options...msf undefined(rce_cve_2022_28368) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub