PT-2020-19771 · Browserless · Browserless-Chrome

Sam Sanoop · Published 2020-11-02 · Updated 2022-10-19 · CVE-2020-7758

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions browserless-chrome versions prior to 1.43.0

Description The issue affects browserless-chrome, where user input from the "workspace endpoint" is used to create a file path filePath. This filePath is then fetched and sent back to the user, allowing for the potential to escape and fetch arbitrary files from a server.

Recommendations For versions prior to 1.43.0, update to version 1.43.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the workspace endpoint to minimize the risk of exploitation. Avoid using user input to create file paths until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-7758

GHSA-8P9R-F949-699G

SNYK-JS-BROWSERLESSCHROME-1023657

Affected Products

Browserless-Chrome

References · 12

• 🔥 https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657 · Exploit
• https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6 · Patch
• https://osv.dev/vulnerability/GHSA-8p9r-f949-699g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7758 · Security Note
• https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable · Note
• https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175 · Note
• https://github.com/browserless/chrome · Note
• https://t.me/cvenotify/5755 · Telegram Post
• https://t.me/cvenotify/5725 · Telegram Post
• https://npmjs.com/package/browserless-chrome · Note
• https://t.me/cibsecurity/15788 · Telegram Post