CVE-2024-51058

What it actually does

The vulnerability allows reading arbitrary server files through manipulation of the src attribute in img tags processed by the TCPDF library during PDF generation.

Why it matters to the business

Attackers could access sensitive configuration files, credentials, or other data stored on the server, leading to further compromise or data breaches. The library is widely used, increasing potential impact.

How an attack unfolds

An attacker supplies crafted HTML containing an img tag with a src pointing to a local file path like file:///etc/passwd, which TCPDF includes in the generated PDF, exposing the file contents.

How to fix it

Upgrade to the fixed version in commit bfa7d2b6d455ebf72ebe3d48fbd487ee5a1f6f3b of tecnickcom/tcpdf.

How to confirm the fix worked

Verify the library version is updated to include the fix commit, and test that local file paths in img src are no longer included.

Typical attack path

1. Identify an application using TCPDF to generate PDFs from user-controlled HTML
2. Craft malicious HTML with img src set to local file path
3. Trigger PDF generation
4. Retrieve the PDF containing the file contents

How to detect it

Look for PDF generation logs or requests that include suspicious image sources pointing to local paths; check generated PDFs for unexpected content from system files.

What your security team should do

• Update TCPDF to the latest fixed version immediately
• Review applications using TCPDF for user-controlled input in PDF generation
• Implement input sanitization for HTML content
• Monitor for unusual PDF generation requests