Snappy vulnerable to PHAR deserialization, allowing remote code execution
CVE-2023-28115

9.8CRITICAL

Key Information:

Vendor

Knplabs

Status
Snappy
Vendor
CVE Published:
17 March 2023

What is CVE-2023-28115?

The Snappy PHP library, used for generating thumbnails and PDF files, is vulnerable to PHAR deserialization attacks due to inadequate protocol checks before processing file paths. Attackers with the ability to upload files can exploit this vulnerability by using the 'phar://' protocol to unserialize uploaded files, potentially leading to the execution of arbitrary PHP code. This risk is particularly present when Snappy operates within vulnerable frameworks like Laravel or Symfony. Versions earlier than 1.4.2 are affected, but this issue has been addressed in version 1.4.2.

Affected Version(s)

snappy < 1.4.2

References

https://github.com/KnpLabs/snappy/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/KnpLabs/snappy/pull/469
x_refsource_MISC
https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d0...
x_refsource_MISC

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.