CVE-2024-36527 PoC — Puppeteer 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-36527.yaml

Associated Vulnerability

Title:Puppeteer 安全漏洞 (CVE-2024-36527)
Description:Puppeteer是Yeongjin Lee个人开发者的一个网页渲染器。 puppeteer-renderer v.3.2.0 及之前版本存在安全漏洞，该漏洞源于允许攻击者利用文件协议的 URL 参数从服务器读取敏感信息。

Description

puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.

File Snapshot


 id: CVE-2024-36527

info:
  name: Puppeteer Renderer  - Directory Traversal
  author: Stux
  severit

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!