CVE-2022-28368

EPSS 82.4%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Popular PoC on GitHub (16 stars) — exploitation code widely available.

CVSS —EPSS 82.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

03 Apr 2022Published on NVD

05 Apr 2022Metasploit module available

13 Feb 2023Public PoC

Weaponization speed

316 daysto first PoC

2 daysto Metasploit module

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).

Affected products

n/a · n/a

public PoCs found — 5

githubgithub.com/rvzsec/CVE-2022-28368★ 16 githubgithub.com/That-Guy-Steve/CVE-2022-28368-handler★ 0 githubgithub.com/Henryisnotavailable/Dompdf-Exploit-RCE★ 0 cve_referencepacketstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/51270unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/171738/Dompdf-1.2.1-Remote-Code-Execution.html https://github.com/dompdf/dompdf/commit/4c70e1025bcd9b7694b95dd552499bd83cd6141d https://github.com/dompdf/dompdf/issues/2598 https://github.com/dompdf/dompdf/pull/2808 https://github.com/snyk-labs/php-goof https://packagist.org/packages/dompdf/dompdf#v1.2.1 https://snyk.io/blog/security-alert-php-pdf-library-dompdf-rce/