CVE-2022-43984 Browsershot 3.57.3 - Server Side XSS to LFR via HTML
An attacker can read arbitrary local files by injecting file:// URLs into HTML content processed by the Browsershot library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-43984?
CVE-2022-43984 is a high-severity server-side request forgery vulnerability in Browsershot, published on 25 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
Weakness: CWE-79
Which versions are affected by CVE-2022-43984?
2 open source packages ship an affected version, including spatie/browsershot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
spatie/browsershot Packagist | All versions | 3.57.4 |
spatie/browsershot Packagist | All versions | 3.57.4 |
Products include Spatie Browsershot.
How do I fix CVE-2022-43984?
Upgrade spatie/browsershot to 3.57.4 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-43984 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43984 exists.
Other vulnerabilities in Browsershot
Sources
Also known as GHSA-6q49-35h6-rq2p.