Executive brief
phantomjs-seo is a Node.js library used to generate search engine–friendly previews of web pages. An attacker can craft a malicious URL that, when processed by the library, causes it to make unintended requests to internal systems or services, potentially exposing sensitive information or compromising network resources.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the phantomjs-seo npm package affecting all versions through 1.0.0. The vulnerability exists in the core URL handling logic (index.js line 17 area), where insufficient input validation allows an attacker to inject crafted URLs that are passed directly to the underlying PhantomJS headless browser instance. An attacker can exploit this over the network without authentication to trigger requests to arbitrary internal or external endpoints, gaining access to non-public resources or information. No patch appears to be available; users should discontinue use of this package or implement strict URL validation at the application level.
Affected products
- npm phantomjs-seo all versions through 1.0.0
Timeline
- 2020-10-06: disclosed: CVE-2020-7739 published on NVD
- 2021-05-10: advisory: GHSA-j9pj-hx76-92v6 published