GitHub Advisoryadvisory · npm

GHSA-xr9h-9m79-x29g SSRF in Rendertron

MEDIUM Published 2021-03-01 Modified 2021-02-24 Official page ↗
Aliases
CVE-2020-8902
Ecosystem
npm
Packages
rendertron
Severity
Moderate
Weaknesses
CWE-918
Reviewed
2021-02-24

Affected packages

• npm rendertron: < 3.0.0 → fixed in 3.0.0

Description

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.

Related

Alias · CVE (1)

  • CVE-2020-8902 Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References