CVE-2020-7790: browsershot local file inclusion vulnerability
Summary
CVE-2020-7790: browsershot local file inclusion vulnerability. Affects spatie/browsershot versions < 3.40.1. Fixed in 3.40.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spatie/browsershot package is a tool for generating PDFs and images from web pages. It allows users to convert web pages to PDFs by taking screenshots of the pages using headless Chrome. The package is commonly used in PHP applications to automate the process of generating PDFs. However, versions prior to 3.40.1 are vulnerable to a local file inclusion vulnerability.
Vulnerability Detail
The vulnerability in spatie/browsershot allows an attacker to include arbitrary files in the resultant PDF by specifying a URL in the file:// protocol. This means that an attacker can potentially access sensitive files on the server and retrieve their contents. The impact of this vulnerability depends on the files that can be accessed and the permissions of the user running the PHP application.
How To Fix
Minimum fixed version
3.40.1
This is the first release that contains the fix.
composer require spatie/browsershot:3.40.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not possible, a workaround is to avoid using the file:// protocol when specifying URLs in the browsershot package. Instead, use other protocols such as http:// or https:// to access web pages. This will prevent the inclusion of arbitrary files in the resultant PDF.
Conclusion
The spatie/browsershot package is vulnerable to a local file inclusion vulnerability that allows an attacker to include arbitrary files in the resultant PDF. It is recommended to upgrade to version 3.40.1 or later to fix this vulnerability. If upgrading is not possible, avoid using the file:// protocol when specifying URLs in the browsershot package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for spatie/browsershot →
FAQ
The impact of this vulnerability depends on the files that can be accessed and the permissions of the user running the PHP application. An attacker may be able to access sensitive files on the server and retrieve their contents.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using composer.lock.
Yes, the CVSS score for this vulnerability is 5.3. CVSS (Common Vulnerability Scoring System) is a framework for assessing the severity of vulnerabilities.
Yes, you can mitigate the vulnerability by avoiding the use of the file:// protocol when specifying URLs in the browsershot package. Use other protocols such as http:// or https:// to access web pages.
You can find more information about the vulnerability in the GitHub Advisory Database. The link to the specific advisory for this vulnerability is provided in the 'source' field of the 'database_specific' section in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for spatie/browsershot.
