CVE-2023-24813

Executive Summary

CVE-2023-24817 is a critical URI validation bypass in Dompdf, a PHP-based HTML-to-PDF converter, that allows an attacker to trigger arbitrary URL calls with arbitrary protocols via a crafted SVG file. The vulnerability stems from an attribute parsing discrepancy between Dompdf and php-svg-lib, enabling bypass of the previously issued CVE-2023-23924 fix. Successful exploitation can lead to arbitrary unserialize on PHP versions before 8.0.0, potentially resulting in arbitrary file deletion or remote code execution. With a CVSS score of 10.0 and no public exploit code currently available, all Dompdf deployments running versions prior to 2.0.3 that process untrusted SVG input are at risk and should prioritize patching.

Technical Analysis

The vulnerability arises from inconsistent attribute parsing between two distinct parsers in the Dompdf processing pipeline. Dompdf's own parser processes image tags and prioritizes the xlink:href attribute, respecting it even when a standard href attribute is also present. However, when the embedded SVG file is subsequently handed off to the php-svg-lib parser, that library parses only the href attribute and ignores xlink:href.

This differential parsing creates a bypass vector: an attacker can submit an SVG file to Dompdf containing both xlink:href (set to an empty value) and href (set to the attacker's malicious URL). From Dompdf's perspective, the xlink:href attribute is present and "respected," so the file appears to conform to the URI validation rules implemented in the CVE-2023-23924 fix. However, when php-svg-lib later processes the same SVG, it only reads the non-empty href value, which has never been validated by Dompdf's security checks.

The result is that arbitrary URLs with arbitrary protocols (e.g., file://, phar://, gopher://) can be invoked during PDF rendering. On PHP versions prior to 8.0.0, the attacker-chosen protocol can include phar:// deserialization wrappers, which triggers PHP object injection via PHAR metadata. This leads to arbitrary unserialize operations that can result in arbitrary file deletion via built-in destructor gadget chains (e.g., __destruct methods in common PHP classes) or, depending on available classes in the application's autoloaded codebase, full remote code execution.

The attack surface is any application endpoint that accepts SVG input and feeds it into Dompdf for PDF generation. This commonly includes document preview, report generation, invoice download, or any "print to PDF" functionality exposed to users. Because Dompdf is widely used in PHP web applications, the exploitation surface spans numerous web-facing services.

Exploitation Scenarios

The exploitation chain for this vulnerability is inferred from the NVD description and vulnerability class, as no public PoC is currently available. The attack follows this progression:

Step 1 — Reconnaissance/Target Identification: The attacker identifies a target web application that accepts user-supplied SVG files and converts them to PDF using Dompdf. Typical discovery methods include probing endpoints that accept HTML, SVG, or image uploads and render them into PDF documents. Version identification may be possible through error messages, response headers, or observable behavior differences between patched and unpatched versions.

Step 2 — Flaw Trigger: The attacker crafts an SVG file containing an image tag with both xlink:href set to an empty string and href set to a malicious URL. The empty xlink:href satisfies Dompdf's URI validation (as per the CVE-2023-23924 mitigation), while the non-empty href is later parsed by php-svg-lib without any validation. The SVG is submitted to the target application for PDF conversion.

Step 3 — Payload/Execution Method: Depending on the chosen protocol in the href attribute, the attacker can achieve different outcomes. On PHP < 8.0.0, a phar:// wrapper can be used to trigger arbitrary deserialization of the referenced PHAR file, leading to file deletion or RCE through existing gadget chains. On all PHP versions, a file:// URL could be used to include local file contents into the generated PDF, enabling information disclosure. Arbitrary HTTP(S) URLs could be used for SSRF-style interaction with internal services.

Step 4 — Post-Exploitation Impact: In scenarios where arbitrary unserialize is achieved, the attacker can delete arbitrary files on the server, potentially destroying application state, configuration files, or even the entire application. Where suitable gadget classes exist in the application's dependency tree, RCE can be achieved, granting the attacker a foothold on the server. This can then be escalated to lateral movement, data theft, or persistent backdoor installation.

No public PoC is available at the time of this report; this attack chain is inferred from the described vulnerability mechanism and published security research on the Dompdf/php-svg-lib parsing discrepancy.

Impact Assessment

This vulnerability carries a maximum CVSS score of 10.0, reflecting critical severity across all impact dimensions. The attack requires no authentication (PR:N) and no user interaction (UI:N), and can be executed over the network (AV:N) by merely submitting a crafted SVG file to an affected application. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component's security authority.

The confidentiality impact is high: an attacker can read arbitrary local files via file:// protocol handlers and potentially exfiltrate sensitive data through PDF output or error messages. The integrity impact is high: an attacker can alter server-side files, and where RCE is achieved, modify application content or database records. The availability impact is high: arbitrary file deletion can render the application inoperable, and RCE can lead to complete server takeovers or destructive operations.

The blast radius is substantial. Dompdf is one of the most popular PHP PDF generation libraries, with hundreds of thousands of installations across open-source and commercial applications. Any of these applications that accept untrusted SVG input are directly exploitable. Applications on PHP 8.0+ are still at risk for SSRF and local file read, while PHP < 8.0 deployments face the additional arbitrary unserialize exposure. The EPSS score of 0.0249 (83.1st percentile) suggests the exploit is conceptually being discussed in threat intelligence circles, but no in-the-wild exploitation has been confirmed at this writing.

Detection Guidance

Sigma Rule

title: Dompdf SVG URI Validation Bypass (CVE-2023-24813)
id: a3f8d2e1-5b7c-4f9a-8e2d-1c6b9a4f3d8e
status: experimental
description: Detects requests to Dompdf applications containing crafted SVG files with both xlink:href and href attributes, potentially exploiting URI validation bypass.
author: Valtersit Threat Intelligence
date: 2024/11/12
tags:
    - attack.t1190
    - cve.2023-24813
logsource:
    category: webserver
    product: generic
detection:
    selection_svg:
        http.response.body|contains:
            - '<image'
            - 'xlink:href'
            - 'svg'
    selection_malicious_href:
        http.response.body|contains:
            - 'xlink:href=""'
            - "xlink:href=''"
            - 'phar://'
            - 'file://'
    selection_both_attrs:
        # Look for image tags where both xlink:href and href appear together
        http.response.body|re:
            - '<image[^>]*xlink:href\s*=\s*["\']{2}[^>]*href\s*='
            - '<image[^>]*href\s*=\s*["\'][^"\']+["\'][^>]*xlink:href\s*='
    condition: selection_svg and selection_malicious_href and selection_both_attrs
level: critical
falsepositives:
    - Legitimate SVG files that include both href and xlink:href for cross-browser compatibility

YARA Rule

rule dompdf_svg_uri_bypass_cve_2023_24813
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2024-11-12"
        description = "Detects SVG files with both xlink:href and href attributes, indicating potential CVE-2023-24813 exploitation attempts"
        cve = "CVE-2023-24813"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-24813"

    strings:
        $svg_tag = "<svg" ascii nocase
        $image_tag = "<image" ascii nocase
        $xlink_href_empty1 = "xlink:href=\"\"" ascii nocase
        $xlink_href_empty2 = "xlink:href=''" ascii nocase
        $xlink_href_present1 = "xlink:href=" ascii nocase
        $href_present = " href=" ascii nocase
        $phar_wrapper = "phar://" ascii nocase
        $file_wrapper = "file://" ascii nocase
        $http_wrapper = "http://" ascii nocase
        $https_wrapper = "https://" ascii nocase

    condition:
        $svg_tag and $image_tag and
        ($xlink_href_empty1 or $xlink_href_empty2) and
        $href_present and
        ($phar_wrapper or $file_wrapper or $http_wrapper or $https_wrapper)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Dompdf SVG xlink:href Empty Bypass Attempt (CVE-2023-24813)";
    flow:established,to_server;
    content:"<svg"; nocase;
    content:"<image"; nocase;
    content:"xlink:href=\"\""; nocase;
    pcre:"/<image[^>]*xlink:href\s*=\s*[\"']{2}[^>]*\shref\s*=/i";
    classtype:attempted-admin;
    reference:cve,2023-24813;
    sid:150000001;
    rev:1;
    metadata:created_at 2024_11_12, updated_at 2024_11_12;
)

Elastic Detection

// Detect SVG file uploads with both xlink:href and href attributes
sequence by host.name, source.ip with maxspan=10s
  [ file where event.action == "write" and file.extension == "svg" and
    process.name : ("*php*", "*apache*", "*nginx*") ]
  [ file where event.action == "read" and file.extension == "php" and
    process.name : ("*php*", "*apache*", "*nginx*") ]

// Alternative rule for web-accessible endpoints (filebeat + winlogbeat style)
sequence with maxspan=30s
  [ network where event.category == "inbound" and
    destination.port in (80, 443, 8000, 8080, 8443) ]
  [ process where
    event.type == "start" and process.name : ("*php*", "*httpd*", "*nginx*") and
    process.args : ("*svg*", "*dompdf*") ]

Splunk SPL Query

sourcetype=stream:http OR index=web_logs
| where req_body LIKE '%<svg%' AND req_body LIKE '%<image%' 
  AND (req_body LIKE '%xlink:href=""%' OR req_body LIKE "%xlink:href=''%")
  AND req_body LIKE '%href=%'
  AND (req_body LIKE '%phar://%' OR req_body LIKE '%file://%')
| eval exploit_attempt = "CVE-2023-24813"
| table _time, src_ip, dest_ip, url, http_method, user_agent, uri_path, req_body
| sort _time
| stats count by src_ip, dest_ip, uri_path

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100250" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.svg|pdf|document</field>
    <description>CVE-2023-24813 Dompdf SVG URI validation bypass attempt - xlink:href empty with href present</description>
    <regex>(\bxlink:href=""\b.*\bhref=)|(\bhref=.*\bxlink:href=""\b)</regex>
    <group>web_application,cve_2023_24813,attack</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100251" level="15">
    <if_sid>100250</if_sid>
    <regex>\bphar://|file://|gopher://|expect://</regex>
    <description>CVE-2023-24813 exploitation - malicious protocol detected in SVG href with empty xlink:href</description>
    <group>web_application,cve_2023_24813,attack,rce</group>
    <mitre>
      <id>T1190</id>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2023-24813 is rated 2/4 (CLAIMED) — a patch exists per a single source (Debian), but has not been independently confirmed by multiple reputable sources at the time of this writing.

1) Immediate Mitigations (before patch application):

• Disable SVG rendering in Dompdf configuration if the application does not explicitly require SVG-to-PDF conversion functionality. If SVG support is essential, restrict input to sanitized SVG files that have been stripped of all href and xlink:href attributes.
• Implement a WAF rule (Suricata, ModSecurity, or equivalent) to block POST requests containing xlink:href="" alongside a non-empty href attribute within SVG payloads.
• Upgrade to PHP 8.0.0 or later to eliminate the arbitrary unserialize exposure, reducing the worst-case impact from RCE to SSRF and local file disclosure.
• Restrict outbound network access from the web application server using egress filtering — block protocols other than HTTP/HTTPS (reject file://, phar://, gopher://, etc.). This limits SSRF and protocol-wrapping attacks even if the vulnerability is triggered.

2) Patch/Upgrade Steps:

• Upgrade Dompdf to version 2.0.3 or later, which includes commit 95009ea98 addressing this issue. Verify the patched version is in use after upgrade by checking the Dompdf version constant or on-disk version file.
• After upgrading, re-run regression tests on all SVG-to-PDF functionality to confirm that legitimate SVG rendering still works and that malicious SVG payloads (with empty xlink:href + populated href) are properly rejected.
• Subscribe to Dompdf release announcements or monitor the project's GitHub releases page for follow-up security patches.

3) Long-Term Hardening:

• Treat SVG input as untrusted by default. Implement a dedicated SVG sanitizer (e.g., SVGSanitizer in PHP or equivalent) that strips all attributes not on a strict whitelist, removing href, xlink:href, on* event handlers, and foreign objects.
• Adopt a least-privilege architecture for PDF generation services: run Dompdf in a containerized or sandboxed environment with read-only filesystem (except temp writable directories), no network access beyond essential egress, and a dedicated service account with minimal permissions.
• Establish an alerting pipeline for the detection rules provided above, tuning them against legitimate application traffic for one week before setting them to active blocking mode.
• Periodically audit Dompdf version and patch status through automated dependency scanning (e.g., Composer audit, Dependabot, or Snyk).