PT-2020-19756 · Phantomjs · Phantomjs-Seo

Vasilii Ermilov · Published 2020-10-06 · Updated 2021-05-10 · CVE-2020-7739

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions phantomjs-seo (affected versions not specified)

Description The issue allows an attacker to craft a URL that will be passed to a PhantomJS instance, enabling a Server-Side Request Forgery (SSRF) attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

RCE

Weakness Enumeration

CWE-918

CWE-20

Related Identifiers

CVE-2020-7739

GHSA-J9PJ-HX76-92V6

SNYK-JS-PHANTOMJSSEO-609638

Affected Products

Phantomjs-Seo

References · 9

• 🔥 https://snyk.io/vuln/SNYK-JS-PHANTOMJSSEO-609638 · Exploit
• https://osv.dev/vulnerability/CVE-2020-7739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j9pj-hx76-92v6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7739 · Security Note
• https://github.com/areverberi/phantomjs-seo/blob/083f66892f97d67031668decb917389ffc32a94c/index.js%23L17 · Patch
• https://ubuntu.com/security/CVE-2020-7739 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-7739 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-7739 · Security Note
• https://npmjs.com/package/phantomjs-seo · Note