Dompdf RCE via Malicious Font Caching (CVE-2022-28368)

MetasploitMetasploit exploitExploitRubyexploit_multi/http/dompdf_rce_cve_2022_28368

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2022-28368 in dompdf by serving a malicious PHP file disguised as a TrueType font via CSS @font-face, causing dompdf to cache it with a .php extension, then triggering execution by requesting the cached file.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit for CVE-2022-28368. It serves a malicious font file containing a PHP payload, injects CSS to trigger font caching, and then requests the cached file to execute the payload. All behavior is consistent with the described exploit technique and the Metasploit framework's standard operation. No concealed, deceptive, or operator-directed harm beyond the stated exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwaredompdf
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively delivers a PHP payload, causes the target to cache it, and triggers its execution to establish a remote session.

modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:6modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:133modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:209-223

Requirements

  • Ability to inject HTML/CSS into data processed by dompdf (e.g., via XSS, user-controlled form field, or direct parameter).modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:32-34
  • The dompdf font cache directory (lib/fonts/) must be web-accessible.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:33-34
  • For dompdf versions 0.8.6 through 1.2.0, the $isRemoteEnabled option must be set to true.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:29-30

Observed behavior

  • Starts an HTTP server to serve a CSS file and a malicious PHP file with a TrueType font header and embedded PHP payload.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:210-217modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-148
  • Injects a link to the malicious CSS into the target application via GET, POST, or JSON POST parameters.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:151-187
  • Triggers execution of the cached PHP file by sending a GET request to the predicted font cache path.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194
  • Registers the cached PHP file for cleanup after exploitation.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Serves a PHP file with a TrueType font header and embedded base64-encoded payload via an HTTP server, then triggers execution by requesting the cached file.This is the core exploit technique for CVE-2022-28368, matching the module description and public vulnerability details.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-149modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194
Payload Delivery
Uses Metasploit's payload.encoded and Rex::Text.encode_base64 to embed the selected payload into the font file.Standard Metasploit practice; the payload is user-selected and not hardcoded. No hidden or unrelated payload is present.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:133
Cleanup Mechanism
Registers the cached PHP file for cleanup using register_file_for_cleanup.Indicates the module attempts to remove the dropped artifact, consistent with the SideEffects note and standard Metasploit FileDropper mixin usage.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220
Review boundaries

What the analysis did not establish

  • Analysis is based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed; classification is based on static analysis of the provided Ruby code.
  • Only the module source file was reviewed; Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpServer, HttpClient, FileDropper) and the selected payload are not included in the evidence and were not analyzed.
  • The review does not assess the safety or intent of the Metasploit framework itself or any external payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1