SCA: security update for knplabs/knp-snappy (GHSA-92rv-4j2h-8mjj)

critical Tenable Self-Hosted Container Security Plugin ID 412967

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html
page. ## Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain
remote code execution through PHAR deserialization. Version 1.4.2 added a check `if (\strpos($filename,
'phar://') === 0)` in the `prepareOutput` function to resolve this CVE, however if the user is able to
control the second parameter of the `generateFromHtml()` function of Snappy, it will then be passed as the
`$filename` parameter in the `prepareOutput()` function. In the original vulnerability, a file name with a
`phar://` wrapper could be sent to the `fileExists()` function, equivalent to the `file_exists()` PHP
function. This allowed users to trigger a deserialization on arbitrary PHAR files. To fix this issue, the
string is now passed to the `strpos()` function and if it starts with `phar://`, an exception is raised.
However, PHP wrappers being case insensitive, this patch can be bypassed using `PHAR://` instead of
`phar://`. A successful exploitation of this vulnerability allows executing arbitrary code and accessing
the underlying filesystem. The attacker must be able to upload a file and the server must be running a PHP
version prior to 8. This issue has been addressed in commit `d3b742d61a` which has been included in
version 1.4.3. Users are advised to upgrade. Users unable to upgrade should ensure that only trusted users
may submit data to the `AbstractGenerator->generate(...)` function. (CVE-2023-41330)

Plugin Details

Severity: Critical

ID: 412967

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-41330

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/8/2023

Vulnerability Publication Date: 9/6/2023

Reference Information

CVE: CVE-2023-41330

cwe: CWE-502

Detections

Analytics