CVE-2024-32489: TCPDF HTML Syntax XSS Vulnerability

CVE-2024-32489 Overview

CVE-2024-32489 is a cross-site scripting (XSS) vulnerability in TCPDF, a widely used PHP library for generating PDF documents. Versions before 6.7.4 mishandle calls that use HTML syntax, allowing attackers to inject malicious content through crafted HTML input. The flaw is classified as [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Because TCPDF is embedded in many web applications and content management systems, the impact extends across a large ecosystem of PHP-based products. Successful exploitation requires user interaction and can result in limited confidentiality and integrity impact within the victim's browser context.

Critical Impact
Attackers can craft HTML input that abuses TCPDF's tag syntax to execute script content or invoke unintended internal methods when rendered by vulnerable applications.

Affected Products

TCPDF versions prior to 6.7.4
PHP applications embedding vulnerable TCPDF releases (6.6.2 and earlier confirmed)
Debian LTS distributions shipping affected TCPDF packages

Discovery Timeline

2024-04-15 - CVE-2024-32489 published to NVD
2024-03-24 - TCPDF 6.7.4 released with the security fix
2025-06 - Debian LTS security announcement issued
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-32489

Vulnerability Analysis

TCPDF supports a custom HTML-like tag that allows callers to invoke TCPDF methods directly from HTML content passed to the renderer. Prior to 6.7.4, this tcpdf tag syntax did not adequately restrict which methods could be invoked or sanitize the associated parameters. Attackers controlling HTML content submitted to a vulnerable application could abuse this behavior to trigger script-related HTML rendering or unintended method calls.

The issue falls under improper neutralization of script-related HTML tags, mapped to [CWE-80]. Exploitation requires that a victim view or process the attacker-influenced content, which aligns with the requirement for user interaction.

Root Cause

The root cause is insufficient validation of the tcpdf HTML tag and its arguments during HTML-to-PDF processing. The library trusted caller-supplied HTML more than it should have, allowing tag misuse. The upstream fix in 6.7.4 introduced a breaking change to the tcpdf HTML tag syntax and added a new K_ALLOWED_TCPDF_TAGS configuration constant that explicitly enumerates methods callable from HTML input.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker submits crafted HTML through any input surface that flows into TCPDF's HTML rendering functions, such as writeHTML() or writeHTMLCell(). When a victim renders the generated document or preview, the injected content executes in the resulting context, producing scoped XSS-style impact.

text

// Patch note from CHANGELOG.TXT (TCPDF 6.7.4)
+6.7.4 (2024-03-24)
+	- Upgrade tcpdf tag encryption algorithm.
+	- Fix regression issue #699.
+	- Fix security issue.
+	- [BREAKING CHANGE] The tcpdf HTML tag syntax has changed, see example_049.php.
+	- New K_ALLOWED_TCPDF_TAGS configuration constant to set the allowed methods for the tcdpf HTML tag.
+	- Raised minimum PHP version to PHP 5.5.0.

Source: TCPDF Commit 82fc97b

Detection Methods for CVE-2024-32489

Indicators of Compromise

HTTP request bodies containing <tcpdf tags submitted to endpoints that generate PDFs
Unexpected script fragments, event handlers, or entity-encoded payloads in stored HTML rendered by TCPDF
Generated PDF files containing embedded JavaScript or unexpected external references
Application logs showing PDF generation errors correlated with malformed HTML input

Detection Strategies

Inventory application dependencies to identify installations of tcpdf at versions earlier than 6.7.4
Perform static code analysis for calls to writeHTML, writeHTMLCell, and related HTML-processing functions that accept untrusted input
Deploy web application firewall rules that flag or block requests containing <tcpdf tag patterns on PDF-generating endpoints
Review composer.lock and package manifests during CI to fail builds with vulnerable TCPDF versions

Monitoring Recommendations

Monitor PDF generation services for anomalous input patterns or elevated error rates
Log and alert on HTML input containing scripting constructs prior to TCPDF processing
Track outbound network activity from PDF viewers that may indicate script execution in rendered documents

How to Mitigate CVE-2024-32489

Immediate Actions Required

Upgrade TCPDF to version 6.7.4 or later across all applications and dependencies
Audit application code for direct exposure of TCPDF HTML rendering functions to untrusted input
Apply Debian LTS updates on affected distributions per the Debian LTS Security Announcement
Test PDF generation workflows for the breaking change to the tcpdf HTML tag syntax before deploying

Patch Information

The fix is delivered in TCPDF 6.7.4, released 2024-03-24. Review the upstream changes in the TCPDF 6.6.2 to 6.7.4 comparison and the specific commits 51cd1b3 and 82fc97b. The fix introduces the K_ALLOWED_TCPDF_TAGS configuration constant to constrain which methods the tcpdf HTML tag may invoke.

Workarounds

Sanitize and strip HTML input using an allow-list before passing content to TCPDF functions
Remove or filter <tcpdf tags from any user-supplied HTML at the application boundary
Restrict PDF generation endpoints to authenticated users only and rate-limit invocation
Isolate PDF rendering in a sandboxed process with no outbound network access

bash

# Update TCPDF via Composer to the patched version
composer require tecnickcom/tcpdf:^6.7.4
composer update tecnickcom/tcpdf

# Verify installed version
composer show tecnickcom/tcpdf | grep versions

# Configure allowed TCPDF HTML tag methods in tcpdf_config.php
# define('K_ALLOWED_TCPDF_TAGS', '');  # empty string disables method invocation