Quick answers
- Is CVE-2020-8902 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-8902 being exploited in the wild.
- How severe is CVE-2020-8902?
- Informational severity, published 1 March 2021.
- Which products and versions are affected?
- rendertron (npm) SEMVER:introduced=0,fixed=3.0.0.
- Is there a fix for CVE-2020-8902?
- Yes. rendertron (npm): upgrade to 3.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-8902 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-8902?
- Check whether you run rendertron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- rendertron (npm): upgrade to 3.0.0 or later
npm install rendertron@3.0.0
Technical details
Rendertron prior to version 3.0.0 is vulnerable to Server-Side Request Forgery (CWE-918). An attacker can supply a specially crafted webpage to the service that causes the headless Chrome process to render internal or restricted URLs, returning screenshots or content that should not be accessible. The vulnerability requires network access to the Rendertron API endpoint and the ability to control input (the URL to be rendered). Exploitation allows disclosure of internal site content and reconnaissance of internal infrastructure. The fix is available in version 3.0.0 and later, which implements security measures to restrict AppEngine deployments.
Affected products
- Google Rendertron prior to 3.0.0
Identifiers
- CVE-2020-8902
- GHSA-xr9h-9m79-x29g
Timeline
- 2021-02-23: disclosed
- 2021-07-02: patched: Version 3.0.0 released with fix