Description
browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| browserless | browserless | 1.44.0 – ≤ 2.56.7 | — |
References
- Researcher write-up technical-description exploit
- the CDP class enforces getAllowFileProtocol technical-description
- the Playwright class never consults the setting technical-description
- https://github.com/browserless/browserless product
- VulnCheck Advisory: browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass third-party-advisory