Surya 0.22.1 Unauthenticated Arbitrary File Read

Executive Summary

This vulnerability is an unauthenticated arbitrary file read flaw in surya 0.22.1's screenshot server. It affects the /info, /page, and /process routes which accept raw file_path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to functions like Image.open or pypdfium2.PdfDocument. The server returns file contents as base64 and the /info route can check if arbitrary paths exist.

Useful 0 Not Useful 0

Detection Guidance

Check if the surya screenshot server is running on your system by inspecting network services bound to 0.0.0.0. Use commands like 'netstat -tuln | grep 0.0.0.0' or 'ss -tuln | grep 0.0.0.0' to identify listening ports. Test the vulnerable routes by sending HTTP requests to /info, /page, or /process with arbitrary file paths like '/etc/passwd' and observe if base64-encoded file contents are returned.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read sensitive files on the host system without authentication. They can exfiltrate documents, access system files like /etc/passwd, and perform reconnaissance. The server binding to all network interfaces (0.0.0.0) increases exposure, making it risky on shared or cloud hosts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict the surya screenshot server to bind only to localhost (127.0.0.1) instead of 0.0.0.0. Apply input validation to the file_path parameter, sanitizing paths and rejecting absolute paths or traversal sequences (e.g., ..). Enforce authentication for all routes and restrict file_path to an allowed directory, similar to the /upload route. Update to a patched version if available.

Useful 0 Not Useful 0