The css_parser Ruby library's Parser#read_remote_file method is vulnerable to SSRF and local file disclosure due to insufficient validation of URI schemes, hosts, and IP addresses. It follows HTTP redirects recursively, including cross-scheme redirects to file:// URIs, which allows attackers to read arbitrary local files. This vulnerability affects applications that use css_parser with attacker-controlled CSS and the base_uri option, such as Premailer. The vulnerability permits arbitrary HTTP/HTTPS requests to internal and external hosts, local file existence enumeration, and partial local file content disclosure constrained by CSS grammar. Additionally, attacker-controlled gzip payloads can cause resource exhaustion through forced decompression. There is no known patch or official fix available at this time.

Successful exploitation allows attackers to perform SSRF attacks, making arbitrary HTTP/HTTPS requests to internal and external hosts. It also enables local file existence enumeration and partial disclosure of local file contents on the vulnerable system. The vulnerability can lead to resource exhaustion via forced decompression of attacker-controlled gzip payloads. These impacts can compromise confidentiality and availability of the affected system. No known exploits in the wild have been reported so far.

No official patch or fix is currently available for this vulnerability. Users of the css_parser library versions prior to 3.0.0 should avoid processing attacker-controlled CSS with the base_uri option enabled. Monitor vendor advisories for updates regarding patches or official remediation. Until a fix is released, restrict usage scenarios that allow untrusted input to be processed by the vulnerable method.