CVE-2023-28115
Published: 17 March 2023
Summary
CVE-2023-28115 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Knplabs Snappy. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Snappy, a PHP library used for generating thumbnails, snapshots, or PDFs from URLs or HTML pages, is affected by CVE-2023-28115. The flaw stems from insufficient validation of input protocols passed to the file_exists() function in AbstractGenerator.php, allowing PHAR deserialization. This was present in versions prior to 1.4.2 and is tracked under CWE-502 with a CVSS score of 9.8.
An attacker able to upload arbitrary files to the server can supply a phar:// URI, triggering unserialization of the uploaded content and instantiation of attacker-controlled PHP objects. When Snappy is integrated with frameworks such as Laravel or Symfony that contain known property-oriented programming chains, or when an attacker can control the output path of generateFromHtml(), this leads directly to remote code execution.
The maintainers addressed the issue in release 1.4.2 through commits that add protocol checks before file operations; users should upgrade to this version to eliminate the deserialization vector.
EPSS scores for the CVE rose from a low baseline to a peak of 0.1675 (current value 0.1139), indicating increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1015
Vulnerability details
Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it…
more
into the `file_exists()` function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when snappy is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If a user can control the output file from the `generateFromHtml()` function, it will invoke deserialization. This vulnerability is capable of remote code execution if Snappy is used with frameworks or developer code with vulnerable POP chains. It has been fixed in version 1.4.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.