Executive brief
browserless-chrome is a headless browser service that allows users to automate web interactions programmatically. A path traversal vulnerability in the workspace endpoint permits unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive configuration, keys, source code, or other confidential data stored on the host system.
Technical details
The vulnerability exists in the workspace endpoint where user-supplied input is concatenated directly into a file path without proper sanitization or validation. An attacker can inject path traversal sequences (e.g., ../) to escape the intended workspace directory and access any file readable by the application process. The flaw is reachable over the network without authentication or user interaction. Exploitation allows arbitrary file read from the server. The vulnerability was patched in version 1.43.0 by ensuring workspace file paths are validated to remain within the workspace directory.
Affected products
- browserless browserless-chrome before 1.43.0
Timeline
- 2020-11-02: disclosed: CVE-2020-7758 published to NVD
- 2021-05-10: advisory: GHSA-8p9r-f949-699g published
- 2021: patched: Fixed in version 1.43.0