CVE-2022-2393

What it actually does

The flaw permits an authenticated adjacent-network user to request and receive a certificate bound to another identity under directory-based authentication, enabling impersonation without the ability to decrypt protected content.

Why it matters to the business

Attackers can impersonate domain users to access resources or perform actions on their behalf, potentially leading to unauthorized access, compliance violations, and operational disruption; the issue affects widely deployed packages with available fixes after more than four years.

How an attack unfolds

An attacker positioned on the adjacent network who already holds valid credentials leverages the directory-based authentication weakness in the certificate issuance flow to obtain a certificate for a different user identity and then uses that certificate to act as the impersonated user.

How to fix it

Upgrade php-dompdf on Debian 12 and 13 to 2.0.3+dfsg-1; for dompdf/dompdf update to commit 95009ea98230f9b084b040c34e3869ef3dccc9aa or later; disable directory-based authentication if upgrades cannot be applied immediately.

How to confirm the fix worked

Verify package versions match the fixed releases listed for each distribution or confirm the git commit hash; test that directory-based authentication no longer permits cross-identity certificate issuance.

Typical attack path

1. Gain authenticated access on the adjacent network
2. Interact with the directory-enabled certificate issuance service
3. Submit a request that triggers the identity-mapping flaw
4. Receive and install the certificate for the target identity
5. Use the impersonated certificate to access domain resources

How to detect it

Review certificate issuance and authentication logs for requests that result in certificates issued to identities other than the requesting user; look for patterns of adjacent-network authenticated sessions followed by unexpected certificate usage.

What your security team should do

• Apply the listed fixed package versions or git commit immediately
• Audit certificate issuance logs for unexpected identity mappings
• Review and restrict directory-based authentication usage where possible
• Monitor for any new exploitation reports despite low EPSS