Critical Vulnerabilities: Add Security Warning to Package

[amiller-si]

Describe the problem The current version of PhantomJS is vulnerable to SSRF and local file read attacks. These are highly impactful vulnerabilities. From reading the readme, it is evident that this is no longer being developed, but there is no indication that there's known, severe vulnerabilities.

Versions Which PhantomJS version? Tip: 2.1.1 Which OS: Linux, Windows, macOS?: Linux

https://nvd.nist.gov/vuln/detail/CVE-2019-17221 https://nvd.nist.gov/vuln/detail/CVE-2020-7739

I have verified both of these in a test environment.

[michael-hart-github]

@amiller-si Thanks for the info! Do you have any suggestions for alternative programs that might fill the same function as PhantomJS?

I'm currently working my way through The Hacker Playbook: A practical guide to penetration testing by Peter Kim, and he had recommended using an older version of this software. Obviously, I won't want to use this if it's got some known vulnerabilities, and isn't actively being maintained.

[jgonggrijp]

Development is no longer suspended; @ariya has un-archived the project again in 2020. However, he needs much more help than he is getting. Part of the reason he temporarily archived the project in 2018 was that expectations were much higher than he felt he could meet. This is probably also why the README hasn't been updated yet. The best way to get issues fixed, is to submit patches (second best is to donate).

@michael-hart-github PhantomJS is a pretty unique project, so unfortunately there is no direct replacement. Your options are either to use WebDriver to automate a regular web browser such as Firefox, or to use JSDOM.

[michael-hart-github]

@jgonggrijp Thank you kindly for the information. I hope the project goes well. If there is any need for documentation writing, feel free to ping me. :)

[jgonggrijp]

@michael-hart-github Ironically, I'm not (yet) involved in PhantomJS development myself, just keeping a tab on the project. Based on a search for issues with the documentation label, it seems you could currently contribute in that area.

[reviewher]

Playwright can automate WebKit.

[gamer191]

@amiller-si do you know what phantomjs-seo (which is mentioned in the description of CVE-2020-7739) is?

[amiller-si]

@gamer191 It appears to be a rarely used middleware that uses PhantomJS. https://github.com/areverberi/phantomjs-seo However, PhantomJS itself has both SSRF and local file read vulns, so the source of this issue might be slightly mis-attributed as phantomjs-seo vs. PhantomJS.

[stale[bot]]

Due to our very limited maintenance capacity, we need to prioritize our development focus on other tasks. Therefore, this issue will be automatically closed (see #15395 for more details). In the future, if we see the need to attend to this issue again, then it will be reopened. Thank you for your contribution!