search

tecnickcom / TCPDF

Official clone of PHP library to generate PDF documents and barcodes
https://tcpdf.org
Other
4.18k stars 1.51k forks source link

Possible Path Manipulation vulnerability #502

Closed enferas closed 2 years ago

enferas commented 2 years ago

Hello.

I would like to report for possible Path Manipulation vulnerability.

The source in this file https://github.com/tecnickcom/TCPDF/blob/main/include/tcpdf_static.php. Line 1957

$host = $protocol.'://'.$_SERVER['HTTP_HOST'];

and the sink in line 1979

$ret = @file_get_contents($path);
williamdes commented 2 years ago

Hi,

How to you trigger this vulnerability ?

enferas commented 2 years ago

Hello,

Thank you for your response.

After some deeper checking, I had a mistake that there is no vulnerability.

In this line

$tmp = str_replace($host, $_SERVER['DOCUMENT_ROOT'], $url);

$host is the search word and not replacement word.

I am going to close the issue.