Is CVE-2017-18352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-18352 being exploited in the wild.

How severe is CVE-2017-18352?

Low severity, with a CVSS score of 3, published 7 January 2019.

Which products and versions are affected?

rendertron (npm) SEMVER:introduced=0,fixed=1.1.0.

Is there a fix for CVE-2017-18352?

Yes. rendertron (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-18352 attacked?

It is attacked over the network.

Am I affected by CVE-2017-18352?

Check whether you run rendertron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-18352: Google Rendertron reflected XSS in error reporting

CVE-2017-18352 · Severity: low · CVSS 3 · Published 2019-01-07

Rendertron is a headless Chrome rendering service used to serve fully-rendered web pages to search engines and crawlers. A reflected cross-site scripting (XSS) vulnerability in its error reporting allows an attacker to inject malicious JavaScript through crafted URLs, potentially stealing user session cookies or credentials from anyone who clicks a malicious link.

Technologies: rendertron (npm). Vendors: npm.

Quick answers

Is CVE-2017-18352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-18352 being exploited in the wild.
How severe is CVE-2017-18352?: Low severity, with a CVSS score of 3, published 7 January 2019.
Which products and versions are affected?: rendertron (npm) SEMVER:introduced=0,fixed=1.1.0.
Is there a fix for CVE-2017-18352?: Yes. rendertron (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-18352 attacked?: It is attacked over the network.
Am I affected by CVE-2017-18352?: Check whether you run rendertron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rendertron (npm): upgrade to 1.1.0 or later
```
npm install rendertron@1.1.0
```

Technical details

The vulnerability is a reflected XSS (CWE-79) in Rendertron's error handling mechanism. When an invalid URL is submitted to the service, the error message reflects the user-supplied URL back in the HTTP response without proper sanitization or encoding. An attacker can craft a malicious URL containing JavaScript payload, and when displayed in a victim's browser, the script executes in the context of the Rendertron origin. The attack requires user interaction (clicking a malicious link). The vulnerability affects all versions prior to 1.1.0, which added URL validation to restrict schemes to 'http' and 'https' and improved error message handling.

Affected products

Google Rendertron <1.1.0

Identifiers

CVE-2017-18352
GHSA-j88m-953w-8r2c

Timeline

2019-01-07: disclosed: GHSA published
2017-08-30: patched: PR #88 merged with fix including URL validation and improved error handling

References

https://github.com/GoogleChrome/rendertron/pull/88

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.