Executive brief
Rendertron is a headless Chrome service used to render web pages into images for preview or analysis. Versions before 3.0.0 allow attackers to craft malicious webpages that force Rendertron to access internal sites and systems it can reach, potentially exposing sensitive data or internal infrastructure.
Technical details
Rendertron prior to version 3.0.0 is vulnerable to Server-Side Request Forgery (CWE-918). An attacker can supply a specially crafted webpage to the service that causes the headless Chrome process to render internal or restricted URLs, returning screenshots or content that should not be accessible. The vulnerability requires network access to the Rendertron API endpoint and the ability to control input (the URL to be rendered). Exploitation allows disclosure of internal site content and reconnaissance of internal infrastructure. The fix is available in version 3.0.0 and later, which implements security measures to restrict AppEngine deployments.
Affected products
- Google Rendertron prior to 3.0.0
Timeline
- 2021-02-23: disclosed
- 2021-07-02: patched: Version 3.0.0 released with fix