Dompdf: File existence oracle via font-face stylesheet declaration

• < 3.1.6

## Description Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw is the discrepancy in system behavior: 1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation. 2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached. This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions. Some factors impact the ability of attackers to exploit the vulnerability: - The attacker must be allowed to provide unrestricted and/or unsanitized HTML content. - System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error. - HTTP GET querystring or POST body must allow large data - Memory limits must be low enough that Dompdf can trigger an overflow - `$_dompdf_show_warnin

GitHub Advisory Database

• ECOSYSTEM: introduced 0; fixed 3.1.6

## Description Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw is the discrepancy in system behavior: 1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation. 2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached. This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions. Some factors impact the ability of attackers to exploit the vulnerability: - The attacker must be allowed to provide unrestricted and/or unsanitized HTML content. - System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error. - HTTP GET querystring or POST body must allow large data - Memory limits must be low enough that Dompdf can trigger an overflow - `$_dompdf_show_warnin

GitHub Advisory Database via OSV