Adithya Pawar

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

Dompdf RCE via Malicious Font Caching (CVE-2022-28368)

Metasploit exploitby Fabian BräunleinAdded to Metasploit 2026-05-19ExploitCVE-2022-283681 file

exploit_multi/http/dompdf_rce_cve_2022_28368 · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2022-28368 in dompdf by serving a malicious PHP file disguised as a TrueType font via CSS @font-face, causing dompdf to cache it with a .php extension, then triggering execution by requesting the cached file.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2022-28368. It serves a malicious font file containing a PHP payload, injects CSS to trigger font caching, and then requests the cached file to execute the payload. All behavior is consistent with the described exploit technique and the Metasploit framework's standard operation. No concealed, deceptive, or operator-directed harm beyond the stated exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwaredompdf
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively delivers a PHP payload, causes the target to cache it, and triggers its execution to establish a remote session.

modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:6modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:133modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:209-223

Requirements

  • Ability to inject HTML/CSS into data processed by dompdf (e.g., via XSS, user-controlled form field, or direct parameter).modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:32-34
  • The dompdf font cache directory (lib/fonts/) must be web-accessible.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:33-34
  • For dompdf versions 0.8.6 through 1.2.0, the $isRemoteEnabled option must be set to true.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:29-30

Observed behavior

  • Starts an HTTP server to serve a CSS file and a malicious PHP file with a TrueType font header and embedded PHP payload.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:210-217modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-148
  • Injects a link to the malicious CSS into the target application via GET, POST, or JSON POST parameters.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:151-187
  • Triggers execution of the cached PHP file by sending a GET request to the predicted font cache path.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194
  • Registers the cached PHP file for cleanup after exploitation.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThis is the core exploit technique for CVE-2022-28368, matching the module description and public vulnerability details.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-149modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194
Payload Delivery
Payload withheldStandard Metasploit practice; the payload is user-selected and not hardcoded. No hidden or unrelated payload is present.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:133
Cleanup Mechanism
Payload withheldIndicates the module attempts to remove the dropped artifact, consistent with the SideEffects note and standard Metasploit FileDropper mixin usage.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220
Review boundaries

What the analysis did not establish

  • Analysis is based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed; classification is based on static analysis of the provided Ruby code.
  • Only the module source file was reviewed; Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpServer, HttpClient, FileDropper) and the selected payload are not included in the evidence and were not analyzed.
  • The review does not assess the safety or intent of the Metasploit framework itself or any external payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.