ASA-2019-00634 – PhantomJS: Arbitrary File Read Vulnerability

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00634

Identifier(s)

ASA-2019-00634, CVE-2019-17221

Title

Arbitrary File Read Vulnerability

Vendor(s)

Ariya Hidayat

Product(s)

PhantomJS

Affected version(s)

PhantomJS versions up to and including 2.1.1

Fixed version(s)

This product is no longer developed

Proof of concept

Yes

Description

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file.

Technical details

Unknown

Credits

DarkMatter’s xen1thLab

Reference(s)

Breaching the perimeter – PhantomJs Arbitrary file read
https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/

CVE-2019-17221
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17221

CVE-2019-17221
https://nvd.nist.gov/vuln/detail/CVE-2019-17221

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: December 3, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.