CVE-2024-36527

Deeper analysis

CVE-2024-36527 is a directory traversal vulnerability, tracked as CWE-22, affecting puppeteer-renderer versions 3.2.0 and earlier. The flaw resides in the handling of the URL parameter, which accepts the file protocol and permits unauthorized access to files on the underlying server. It carries a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and low privileges required, with high impact on confidentiality but none on integrity or availability.

An authenticated attacker can supply a crafted file:// URL to the renderer service and retrieve arbitrary sensitive files from the host filesystem. Because the vulnerability requires only low privileges and no user interaction, any party able to reach the puppeteer-renderer endpoint can leverage it to disclose configuration data, source code, or other protected information stored on the server.

The supplied references consist solely of a public gist containing exploitation details; no vendor advisory, patch information, or mitigation guidance is included. The associated EPSS score has reached a peak of 0.8959 with a current value of 0.8911, indicating sustained exploitation interest since disclosure.