Is CVE-2017-18353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-18353 being exploited in the wild.

How severe is CVE-2017-18353?

Low severity, with a CVSS score of 3, published 4 January 2019.

Which products and versions are affected?

rendertron (npm) SEMVER:introduced=0,fixed=1.1.0.

Is there a fix for CVE-2017-18353?

Yes. rendertron (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-18353 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-18353?

Check whether you run rendertron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-18353: Google rendertron unauthorized Chrome shutdown via _ah/stop route

CVE-2017-18353 · Severity: low · CVSS 3 · Published 2019-01-04

Rendertron is a headless Chrome rendering service used to generate page snapshots and pre-render content for web applications. An unprotected administrative endpoint allows any remote attacker to send a single HTTP request and shut down the entire Chrome instance, causing a complete denial of service to all users relying on the rendering service.

Technologies: rendertron (npm). Vendors: npm.

Quick answers

Is CVE-2017-18353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-18353 being exploited in the wild.
How severe is CVE-2017-18353?: Low severity, with a CVSS score of 3, published 4 January 2019.
Which products and versions are affected?: rendertron (npm) SEMVER:introduced=0,fixed=1.1.0.
Is there a fix for CVE-2017-18353?: Yes. rendertron (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-18353 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-18353?: Check whether you run rendertron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rendertron (npm): upgrade to 1.1.0 or later
```
npm install rendertron@1.1.0
```

Technical details

The vulnerability is an improper access control flaw (CWE-284) in the _ah/stop endpoint of Rendertron 1.0.0. This endpoint is responsible for gracefully shutting down the Chrome rendering process but lacks authentication and authorization checks. An attacker can reach this route over the network without credentials or user interaction by simply issuing an HTTP GET request. Successful exploitation immediately terminates the Chrome process, rendering the entire rendering service unavailable to all users. The fix, released in version 1.1.0, restricts exposure of the _ah/stop route to development environments only (when NODE_ENV is set to development), preventing remote exploitation in production deployments.

Affected products

Google rendertron < 1.1.0

Identifiers

CVE-2017-18353
GHSA-4q69-q4q7-x82c

Timeline

2019-01-04: disclosed
2017-08-30: patched: Fix released in version 1.1.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.