Skip to content

Downloads Resources over HTTP in phantomjs-cheniu

High severity GitHub Reviewed Published Feb 18, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm phantomjs-cheniu (npm)

Affected versions

<= 2.0.1

Patched versions

None

Description

Affected versions of phantomjs-cheniu insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running phantomjs-cheniu.

Recommendation

No patch is currently available for this vulnerability.

As this package is just a fork of Medium's phantomjs-prebuilt package, the best mitigation is currently to install the Medium version of phantomjs-prebuilt. This can be done via the following command:

npm i phantomjs-prebuilt

References

Published to the GitHub Advisory Database Feb 18, 2019
Reviewed Jun 16, 2020
Last updated Jan 9, 2023

Severity

High

EPSS score

0.175%
(55th percentile)

Weaknesses

CVE ID

CVE-2016-10661

GHSA ID

GHSA-w364-8vfv-gvf5

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.