Homepage
About Snyk

splash@2.3.1 vulnerabilities

A javascript rendered with a HTTP API

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the splash package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Server-Side Request Forgery (SSRF)

splash is a javascript rendering service with an HTTP API. It’s a lightweight browser with an HTTP API, implemented in Python 3 using Twisted and QT5. It’s fast, lightweight and state-less which makes it easy to distribute.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) via a number of Splash API endpoints (e.g., execute, run). An attacker could send a crafted request to a Splash endpoint, forcing the Splash server to send a further request to the target server.

Furthermore, because Splash processes URLs with the localhost fully-qualified domain name as referring to the Splash server, an attacker need not know the address of the Splash server. Instead scrapers that implement Splash can be exploited if they visit a remote page that contains such a crafted input (see referenced PoC).

PoC by Claudio Salazar

How to fix Server-Side Request Forgery (SSRF)?

There is no fixed version for splash.

[0,)
Go back to all versions of this package