cve/2022/CVE-2022-41343.md

CVE-2022-41343

Description

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

POC

Reference

• https://tantosec.com/blog/cve-2022-41343/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Amodio/h5p_quiz
• https://github.com/BKreisel/CVE-2022-41343
• https://github.com/BKreisel/CVE-2022-46169
• https://github.com/fardeen-ahmed/Bug-bounty-Writeups
• https://github.com/nomi-sec/PoC-in-GitHub