Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-23924 is a critical-severity Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (CWE-551) vulnerability in Dompdf Project Dompdf. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique NTDS (T1003.003); ranked in the top 11% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Dompdf 2.0.1, an HTML-to-PDF conversion library, contains a URI validation flaw that is bypassed during SVG parsing when an attacker supplies <image> tags containing uppercase letters. The bypass permits use of the phar:// wrapper and triggers arbitrary object unserialize on PHP versions prior to 8.0.0. The issue is tracked as CWE-551 and CWE-863 and carries a CVSS 3.1 score of 10.0.
An unauthenticated attacker who can supply a crafted SVG file to a Dompdf instance can invoke arbitrary URL schemes. On affected PHP releases this yields arbitrary deserialization, enabling at minimum file deletion and, depending on available classes, remote code execution.
The project’s security advisory and subsequent commits address the flaw by tightening URI validation; the fix is included in the v2.0.2 release. The associated EPSS score has remained near 0.5 with only minor fluctuation between its recorded peak and current value.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0610
Vulnerability Data
Dompdf is an HTML to PDF converter. The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This may lead to arbitrary object unserialize on PHP < 8, through the `phar`…
more
URL wrapper. An attacker can exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will lead to the very least to an arbitrary file deletion and even remote code execution, depending on classes that are available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct authorization logic after parsing/canonicalization to prevent bypasses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
A.5.18's provisioning, revocation, review and adjustment of access rights (incl. before role changes/termination, with segregation and owner approval) directly stops incorrect authorization decisions from being exploitable in the vast majority of cases; the bounded remainder is incorrectness inside the authorization logic itself (e.g. flawed conditional or missing check) rather than rights that were wrongly granted.
A.8.25 mandates secure SDLC practices (secure coding guidelines, security requirements, checkpoints, testing, developer training) that reach most authorization-before-canonicalization defects when well implemented, but leaves a bounded remainder where flawed parsing logic is introduced despite those practices (e.g. in outsourced development or incomplete enforcement of the guidelines).
Application security requirements should mandate correct authorization order after canonicalization.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, default-deny, assume-breach, distrust-external-input, security-oriented design reviews against known attack patterns) that reach URL parsing/canonicalization-before-authorization and stop the bypass; the bounded remainder is non-web or non-URL authorization flows outside its engineering scope.
Secure coding practices directly address canonicalization and authorization sequencing flaws.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.