Skip to main content

Deserialization of Untrusted Data

CVE-2023-41330

High
9.8/10

Summary

knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check "if (\strpos($filename, 'phar://') === 0)" in the "prepareOutput" function to resolve this CVE, however if the user is able to control the second parameter of the `generateFromHtml()` function of Snappy, it will then be passed as the "$filename" parameter in the "prepareOutput()" function. In the original vulnerability, a file name with a "phar://" wrapper could be sent to the "fileExists()" function, equivalent to the "file_exists()" PHP function. This allowed users to trigger a deserialization on arbitrary PHAR files. To fix this issue, the string is now passed to the "strpos()" function and if it starts with `phar://`, an exception is raised. However, PHP wrappers being case insensitive, this patch can be bypassed using `PHAR://` instead of `phar://`. A successful exploitation of this vulnerability allows executing arbitrary code and accessing the underlying filesystem. The attacker must be able to upload a file and the server must be running a PHP version prior to 8. This issue affects version 1.4.2. Users unable to upgrade to fix version 1.4.3 should ensure that only trusted users may submit data to the "AbstractGenerator->generate(...)" function.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-502 - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerabilities enable an attacker to replace or manipulate a serialized object, replacing it with malicious data. When the object is deserialized at the victim's end the malicious data is able to compromise the victim’s system. The exploit can be devastating, its impact may range from privilege escalation, broken access control, or denial of service attacks to allowing unauthorized access to the application's internal code and logic which can compromise the entire system.

References

Advisory Timeline

  • Published