CVE-2024-21549: Browsershot Improper Input Validation vulnerability

December 20, 2024 (updated February 4, 2025)

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file.

Note:

This is a bypass of the fix for CVE-2024-21544.

References

github.com/advisories/GHSA-c9f5-29f6-c35w
github.com/spatie/browsershot
github.com/spatie/browsershot/commit/f791ce0ae8dd99367dbfa30588ee31e1196e1728
github.com/spatie/browsershot/discussions/906
nvd.nist.gov/vuln/detail/CVE-2024-21549
security.snyk.io/vuln/SNYK-PHP-SPATIEBROWSERSHOT-8533023

Code Behaviors & Features

Detect and mitigate CVE-2024-21549 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →