Listen to this Post
Introduction
The mPDF PHP library, a cornerstone for converting HTML to PDF in PHP applications, has recently been flagged for a subtle but serious security flaw. Despite over 70 million installations on Packagist, this widely used open-source tool could allow attackers to exploit server-side request forgery (SSRF) vulnerabilities, even when developers believe their input sanitization is secure. The issue revolves around the way mPDF handles CSS @import rules, potentially putting internal networks and sensitive systems at risk.
Understanding the Vulnerability
mPDF’s vulnerability originates from its CSS parsing process. The library uses regex to scan HTML input for @import url() statements, intending to fetch external CSS files. The problem is that the regex operates on the entire HTML document instead of isolating only CSS sections. This oversight allows attackers to embed malicious @import statements outside of