Executive Summary

The vulnerability in php-weasyprint versions prior to 2.5.1 arises from improper handling of the WeasyPrint binary path when building shell commands. The library uses escapeshellarg() to quote the binary path, but then checks the quoted string with is_executable(), which fails because the quotes become part of the filename. This causes the safe code branch to never execute, allowing the raw, unescaped binary path to be passed directly to the shell command execution function.

If the binary path is sourced from configuration, environment variables, or per-tenant settings, an attacker can supply a malicious binary path containing shell commands. This leads to shell command injection, enabling arbitrary command execution with the privileges of the PHP process.

The issue is similar to a previously patched vulnerability in the KnpLabs/snappy library and was fixed in php-weasyprint version 2.5.1 by properly validating and escaping the binary path before use.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to shell command injection, allowing an attacker to execute arbitrary commands on the server running php-weasyprint.

• Execution of malicious commands with the privileges of the PHP process.
• Potential full compromise of the server environment.
• Data theft, data loss, or unauthorized access to sensitive information.
• Disruption of service or system integrity.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the php-weasyprint library version in use is 2.5.0 or below, as these versions contain the flawed logic in handling the WeasyPrint binary path.

Specifically, detection involves verifying whether the binary path used by php-weasyprint is sourced from configuration, environment variables, or per-tenant settings and whether it is properly validated and escaped before execution.

A practical approach is to check if the binary path is executable without quotes, since the vulnerability arises from an incorrect is_executable() check on a quoted path.

• Run a command to check if the binary path is executable without quotes, for example: `is_executable('/usr/local/bin/weasyprint')` in PHP or `test -x /usr/local/bin/weasyprint` in a shell.
• Inspect environment variables or configuration files for the binary path to see if they contain unexpected or malicious content that could lead to command injection.
• Look for suspicious shell commands or unexpected files created by potential exploitation, e.g., check for unexpected files like `/tmp/snappy_rce` as seen in similar vulnerabilities.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the php-weasyprint library to version 2.5.1 or later, where the vulnerability has been fixed.

The fix involves modifying the buildCommand() function to properly verify that the binary path is executable before escaping it and using it in shell commands.

If upgrading immediately is not possible, as a workaround, manually verify that the binary path is executable and safe before passing it to the php-weasyprint constructor or setBinary() method.

Additionally, ensure that the binary path is not sourced from untrusted user input, environment variables, or per-tenant settings without validation.

Consider applying the patch from the official repository that introduces a protected method to validate and escape the binary path, throwing an exception if the binary is not executable.

Useful 0 Not Useful 0