Executive brief
Rendertron is a headless Chrome rendering service used to serve fully-rendered web pages to search engines and crawlers. A reflected cross-site scripting (XSS) vulnerability in its error reporting allows an attacker to inject malicious JavaScript through crafted URLs, potentially stealing user session cookies or credentials from anyone who clicks a malicious link.
Technical details
The vulnerability is a reflected XSS (CWE-79) in Rendertron's error handling mechanism. When an invalid URL is submitted to the service, the error message reflects the user-supplied URL back in the HTTP response without proper sanitization or encoding. An attacker can craft a malicious URL containing JavaScript payload, and when displayed in a victim's browser, the script executes in the context of the Rendertron origin. The attack requires user interaction (clicking a malicious link). The vulnerability affects all versions prior to 1.1.0, which added URL validation to restrict schemes to 'http' and 'https' and improved error message handling.
Affected products
- Google Rendertron <1.1.0
Timeline
- 2019-01-07: disclosed: GHSA published
- 2017-08-30: patched: PR #88 merged with fix including URL validation and improved error handling