Executive brief
PhantomJS is a headless browser engine used to automate web page rendering and testing. This vulnerability allows attackers to read arbitrary files from the server by supplying a specially crafted HTML file that uses file:// URIs in XMLHttpRequest calls. The vulnerability enables unauthorized access to sensitive files on systems running PhantomJS, potentially exposing credentials, configuration data, or other confidential information.
Technical details
PhantomJS versions through 2.1.1 contain an arbitrary file read vulnerability in the page.open() function of the webpage module. The vulnerability exists because the browser allows XMLHttpRequest calls to file:// protocol URIs without proper validation or restrictions. An attacker can craft an HTML file that, when processed by PhantomJS (particularly if the result is rendered via page.render()), reads and exfiltrates arbitrary files from the filesystem. The attack requires the attacker to control the input HTML file supplied to PhantomJS. The product is no longer developed and patches are not expected.
Affected products
- Medium PhantomJS through 2.1.1
Timeline
- 2019-11-05: disclosed
- 2022-05-24: advisory