GHSA-6q49-35h6-rq2p

Browsershot version 3.57.3 vulnerable to improper input validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-43984

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	spatie/browsershot	< 3.57.4	3.57.4

Details

As written in the advisory (Markdown source, shown as plain text).

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-43984 advisory
https://github.com/spatie/browsershot/commit/554c3e566fde8c47ad1ac9be47eaeb9a84c4dfe2 web
https://github.com/spatie/browsershot/commit/92cf16fc098211731f80d21687abeafbe2c457ad web
https://fluidattacks.com/advisories/malone web
https://github.com/spatie/browsershot web