CVE-2019-17221 PhantomJS Arbitrary File Read
An attacker can read arbitrary files on the filesystem by supplying a crafted HTML file to PhantomJS, which is no longer maintained.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17221?
CVE-2019-17221 is a high-severity path traversal vulnerability in n/a, published on 5 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
Weakness: CWE-552
Which versions are affected by CVE-2019-17221?
2 open source packages ship an affected version, including phantomjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phantomjs npm | All versions to 2.1.1 | None |
phantomjs npm | All versions to 2.1.1 | None |
Products include Phantomjs Phantomjs.
How do I fix CVE-2019-17221?
No fix has been published for CVE-2019-17221 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-17221 being exploited?
There is no known exploitation of CVE-2019-17221 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-x43g-gj9x-838x, UBUNTU-CVE-2019-17221.