LiveActive security incident?Get immediate response
CVE Record

CVE-2024-21544: Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to...

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.

HighCVSS 8.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Browsershot versions before 5.0.1 may let an attacker-controlled URL expose sensitive files from the application server. The flaw bypasses URL validation using leading whitespace before a local-file URL. Impact depends on whether untrusted users can influence URLs passed to Browsershot.

Executive priority

Treat this as urgent when vulnerable Browsershot versions support public or untrusted rendering requests, because exploitation requires no account or user interaction. Prioritize upgrading exposed services and checking whether readable server files contain credentials. Lower priority is reasonable only after proving untrusted input cannot reach setUrl.

Technical view

CVE-2024-21544 is an improper input validation flaw in spatie/browsershot setUrl. Leading whitespace can bypass protocol validation and permit local file inclusion. The supplied CVSS v3.1 score is 8.6, reflecting network access, low complexity, no required privileges or interaction, and potentially high confidentiality impact.

Likely exposure

Exposure is most likely where an application runs spatie/browsershot before 5.0.1 and passes externally influenced values into setUrl. Internet-facing document, screenshot, or rendering workflows warrant immediate review. Installation alone does not establish exploitability; the vulnerable method must be reachable with attacker-controlled input.

Exploitation context

The source bundle reports a proof-of-concept maturity metric, but provides no evidence of active exploitation. CVE-2024-21544 is not listed as KEV in the supplied data. Successful exploitation could read files accessible to the server process, potentially exposing credentials, configuration, or other sensitive information.

Researcher notes

The weakness is classified as CWE-20. The supplied vector indicates changed scope and high confidentiality impact, with no claimed integrity or availability impact. The public references include the affected code and corrective commit. Assess reachability, input provenance, process permissions, and sensitive files readable by the renderer.

Mitigation direction

  • Upgrade spatie/browsershot to version 5.0.1 or later.
  • Prevent untrusted input from reaching setUrl until the upgrade is complete.
  • Follow current package-maintainer guidance for any additional remediation.
  • Restrict the rendering process account to only necessary files and resources.

Validation and detection

  • Inventory Composer manifests, lockfiles, containers, and deployed runtimes for the installed Browsershot version.
  • Trace setUrl call paths and identify any values influenced by requests or other untrusted sources.
  • Confirm every deployed instance runs version 5.0.1 or later.
  • Regression-test that leading-whitespace local-file URLs are rejected using only non-sensitive fixtures.
  • Review relevant application logs for suspicious local-file URL submissions.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-20: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-21544 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.6 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.6CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P3.94snyk
7.7CVSS 4.0HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P——snyk

Vulnerability scoring details

Base CVSS 4.0 score

7.7High
CVSS 4.0 vector shape for CVE-2024-21544Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aspatie/browsershot0Listed
Weakness

CWE details

CWE-20

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-20 · source CWE mapping

CWE mapping pending import

This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.

Open CWE intelligenceSame-CWE CVEs