Executive brief
Rendertron is a service that renders web pages to static HTML, commonly used by search engines and other tools for indexing. A vulnerability in version 1.0.0 allows remote attackers to read arbitrary files from the server by exploiting improper URL validation, enabling unauthorized access to sensitive files without any authentication.
Technical details
Rendertron 1.0.0 is vulnerable to local file inclusion (CWE-22) due to insufficient URL validation. The service accepts alternative protocols (such as 'file://') in addition to HTTP/HTTPS, allowing attackers to craft requests that access the local filesystem. The vulnerability requires only network access and no authentication or user interaction. An attacker can read arbitrary files on the affected server by specifying file:// URLs. The issue was fixed in version 1.1.0 by adding strict URL validation to only permit 'http' and 'https' protocols.
Affected products
- Google Rendertron 1.0.0
Timeline
- 2019-01-04: disclosed
- 1.1.0: patched