CVE-2022-41706 Browsershot 3.57.2 - Server Side XSS to LFR via URL
An attacker can read arbitrary local files by manipulating the URL protocol in Browsershot, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-41706?
CVE-2022-41706 is a high-severity server-side request forgery vulnerability in Browsershot, published on 25 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
Weakness: CWE-79
Which versions are affected by CVE-2022-41706?
2 open source packages ship an affected version, including spatie/browsershot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spatie/browsershot Packagist | All versions | 3.57.3 |
spatie/browsershot Packagist | All versions | 3.57.3 |
Products include Spatie Browsershot.
How do I fix CVE-2022-41706?
Upgrade spatie/browsershot to 3.57.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-41706 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41706 exists.
Other vulnerabilities in Browsershot
Sources
Also known as GHSA-8c2c-jxwj-jqgf.