Spatie Browsershot Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Spatie Browsershot package, specifically in versions 0.0.0 and later. The issue arises in the setUrl() function, where user input is not properly validated. This lack of restriction allows attackers to access localhost and enumerate its directories.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local resources and information.

Reproduction

To reproduce this vulnerability, upload a script that utilizes the Spatie Browsershot package and calls the setUrl() function with a URL pointing to localhost. Once the script is executed, it will access the local server and list its directories, demonstrating the SSRF vulnerability.