Summary
Dompdf versions through 3.15 can expose whether local files exist when attacker-controlled HTML uses CSS font references to access the local filesystem. Repeated processing of existing files can exhaust PHP memory, creating an observable difference that may let an attacker enumerate sensitive paths and potentially disrupt PDF generation.
Affected context
The issue occurs in Dompdf deployments that process attacker-controlled or insufficiently sanitized HTML and permit CSS @font-face references to local resources. Risk is higher when requests accept large HTML documents, local file access is available to the renderer, and the configured PHP or application memory limit can be reached during repeated processing. Chroot restrictions may not fully prevent the oracle because the observable behavior can reveal whether a referenced path exists within the accessible environment.
Exploit preconditions
- Attack surface: An application endpoint that converts user-influenced HTML into PDF documents
- Required access: Ability to submit HTML containing CSS font references, without adequate sanitization or resource restrictions
- Trigger point: Dompdf processing of local file references in CSS
@font-facedirectives - Environmental condition: The renderer must be able to access candidate local paths and have a memory limit that can be exhausted
- Why exploitation is possible: Existing and missing files produce distinguishable processing outcomes, allowing file existence to be inferred from resource exhaustion or failure behavior
Why this happens
The vulnerability results from exposing local resource resolution through CSS processing and producing distinguishable outcomes based on file existence. Existing files can enter a repeated or resource-intensive processing path, while nonexistent files fail quickly or are ignored. This behavior maps to CWE-203: Observable Discrepancy, because externally visible differences reveal information about internal state. The same processing path can also create a denial-of-service condition when memory consumption is not sufficiently bounded.
Potential impact
- An attacker may enumerate sensitive file paths within the renderer's accessible filesystem
- Confidential configuration, application, or environment information could be exposed indirectly
- PDF conversion requests may consume excessive memory and fail
- Application worker processes could crash or become unavailable
- Repeated requests could contribute to broader service degradation
General mitigation guidance
Mitigation generally focuses on reducing trust in submitted HTML and preventing document rendering from resolving local resources.
Common defensive patterns include:
- Disable local file access and external resource resolution unless explicitly required
- Sanitize HTML and CSS with an allowlist that excludes local file references and unsafe directives
- Enforce strict limits on document size, CSS complexity, rendering time, and memory consumption
- Use isolated rendering workers with least-privilege filesystem permissions and minimal readable data
- Return uniform responses and avoid exposing detailed renderer warnings or memory errors to untrusted callers
- Apply defense-in-depth monitoring and rate limits to resource-intensive conversion endpoints
How teams detect issues like this
Organizations can look for:
- Static analysis and code review signals showing user-controlled HTML passed directly to PDF rendering
- Configuration review findings where local file access, unrestricted URI resolution, or verbose renderer warnings are enabled
- Policy checks requiring HTML and CSS sanitization before document conversion
- Runtime telemetry showing repeated conversion failures, memory exhaustion, unusually large documents, or probing-like sequences of file references
- Automated security review rules that flag PDF renderers handling untrusted content without resource and filesystem restrictions
