CVE-2020-7758
📋 TL;DR
CVE-2020-7758 is a path traversal vulnerability in browserless-chrome that allows attackers to read arbitrary files on the server. This affects all users running browserless-chrome versions before 1.40.2-chrome-stable. The vulnerability occurs when user input from the workspace endpoint is improperly sanitized before being used in file operations.
💻 Affected Systems
- browserless-chrome
📦 What is this software?
Chrome by Browserless
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files, or credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to sensitive server files including configuration files, environment variables, and application data.
If Mitigated
Limited impact with proper network segmentation and file system permissions restricting access to critical system files.
🎯 Exploit Status
The vulnerability is straightforward to exploit with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.40.2-chrome-stable
Vendor Advisory: https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable
Restart Required: Yes
Instructions:
1. Update browserless-chrome to version 1.40.2-chrome-stable or later. 2. Restart the browserless-chrome service. 3. Verify the fix by checking the version and testing the vulnerability.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to browserless-chrome to trusted IP addresses only
iptables -A INPUT -p tcp --dport [browserless-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [browserless-port] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate browserless-chrome from sensitive systems
- Apply strict file system permissions to limit what files browserless-chrome can access
🔍 How to Verify
Check if Vulnerable:
Check if browserless-chrome version is below 1.40.2-chrome-stableCheck Version:
docker images | grep browserless/chromeVerify Fix Applied:
Verify browserless-chrome version is 1.40.2-chrome-stable or later and test that path traversal attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in browserless-chrome logs
- Multiple failed path traversal attempts
Network Indicators:
- HTTP requests containing '../' patterns to workspace endpoint
- Unusual file download patterns
SIEM Query:
source="browserless-chrome" AND (url="*../*" OR status=500)🔗 References
- https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175
- https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6
- https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable
- https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657
- https://github.com/browserless/chrome/blob/master/src/routes.ts%23L175
- https://github.com/browserless/chrome/commit/848b87e5bea4f8473eea85261a5ff922d6ebd2b6
- https://github.com/browserless/chrome/releases/tag/1.40.2-chrome-stable
- https://snyk.io/vuln/SNYK-JS-BROWSERLESSCHROME-1023657
