composiohq/composio · Security
composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL
- GHSA ID
- GHSA-38mg-wm59-g64x
- CVE ID
- CVE-2024-8955
- Severity
- medium
- Published
- Updated
- CVSS
- 6.8 · CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- CVSS v3
- 6.8 · CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Description
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.
CWEs
- CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')
- CWE-918 · Server-Side Request Forgery (SSRF)