CVE-2023-41330
📋 TL;DR
This vulnerability in knplabs/knp-snappy allows remote code execution through PHAR deserialization when attackers can control the filename parameter in generateFromHtml(). The case-insensitive patch in version 1.4.2 can be bypassed using uppercase 'PHAR://'. PHP applications using this library with user-controlled input are affected.
💻 Affected Systems
- knplabs/knp-snappy
📦 What is this software?
Snappy by Knplabs
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing arbitrary code execution, file system access, and potential lateral movement within the network.
Likely Case
Remote code execution leading to data theft, backdoor installation, or service disruption.
If Mitigated
No impact if input validation prevents user-controlled filenames or if PHP 8+ is used.
🎯 Exploit Status
Exploitation requires user input control and file upload capability. The vulnerability is well-documented with public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.3
Vendor Advisory: https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
Restart Required: No
Instructions:
1. Update composer.json to require 'knplabs/knp-snappy: ^1.4.3'. 2. Run 'composer update knplabs/knp-snappy'. 3. Verify the update with 'composer show knplabs/knp-snappy'.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation on user-controlled filename parameters to prevent PHAR wrapper usage.
PHP Version Upgrade
allUpgrade to PHP 8.0 or later where PHAR deserialization is disabled by default.
🧯 If You Can't Patch
- Restrict user input to the generateFromHtml() function to trusted sources only.
- Implement web application firewall rules to block requests containing PHAR wrapper patterns.
🔍 How to Verify
Check if Vulnerable:
Check composer.lock or run 'composer show knplabs/knp-snappy' to see if version is below 1.4.3.Check Version:
composer show knplabs/knp-snappy | grep versionsVerify Fix Applied:
Confirm version is 1.4.3 or higher using 'composer show knplabs/knp-snappy'.📡 Detection & Monitoring
Log Indicators:
- Unusual file generation requests with PHAR wrapper patterns
- Exceptions from knp-snappy library
Network Indicators:
- HTTP requests with PHAR:// or phar:// in parameters
SIEM Query:
source="web_logs" AND (phar:// OR PHAR://)🔗 References
- https://github.com/KnpLabs/snappy/commit/d3b742d61a68bf93866032c2c0a7f1486128b67e
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
- https://github.com/KnpLabs/snappy/commit/d3b742d61a68bf93866032c2c0a7f1486128b67e
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
