GitHub Advisoryadvisory · Packagist

GHSA-c9f5-29f6-c35w Browsershot Improper Input Validation vulnerability

MEDIUM Published 2024-12-20 Modified 2025-02-04 Official page ↗
Aliases
CVE-2024-21549
Ecosystem
Packagist
Packages
spatie/browsershot
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-125, CWE-20, CWE-200
Reviewed
2024-12-20

Affected packages

• Packagist spatie/browsershot: < 5.0.3 → fixed in 5.0.3

Description

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. Note: This is a bypass of the fix for CVE-2024-21544.

Related

Alias · CVE (1)

  • CVE-2024-21549 Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the… vulnerability

Weakness · CWE (3)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References