Executive brief
phantomjs-cheniu is a Node.js package that provides an embedded browser engine for web automation and testing. The package downloads its core executable over an unencrypted HTTP connection instead of HTTPS, allowing an attacker on the network to intercept and replace it with malicious code. This could lead to complete compromise of any system using the package.
Technical details
This vulnerability is a missing encryption issue (CWE-311) where phantomjs-cheniu downloads an executable over unencrypted HTTP. An attacker with a privileged network position (man-in-the-middle capability) can intercept the HTTP response and substitute the legitimate executable with malicious code. The attack requires network-level access but no authentication or user interaction beyond the normal installation or execution of the package. The vulnerability affects all versions through 2.0.1 with no official patch available; the recommended mitigation is to switch to the upstream phantomjs-prebuilt package from Medium.
Affected products
- npm phantomjs-cheniu <= 2.0.1
Timeline
- 2019-02-18: disclosed: Published to GitHub Advisory Database