CVE-2020-8902 SSRF in Rendertron

What is CVE-2020-8902?

CVE-2020-8902 is a low-severity vulnerability in Google LLC Rendertron, published on 23 Feb 2021.

Official description

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.

Weakness: CWE-918, CWE-284

Which versions are affected by CVE-2020-8902?

2 open source packages ship an affected version, including rendertron. It affects 1 product.

Products include Google Rendertron.

How do I fix CVE-2020-8902?

Upgrade rendertron to 3.0.0 or later.

Is CVE-2020-8902 being exploited?

There is no known exploitation of CVE-2020-8902 in the wild and no public exploit code.

Other vulnerabilities in Google LLC Rendertron

• CVE-2017-18353 rendertron can remotely shut down Chrome instance High 7.5
• CVE-2017-18354 rendertron LFI vulnerability High 7.5
• CVE-2017-18355 Rendertron discloses absolute paths of files High 7.5
• CVE-2017-18352 rendertron XSS vulnerability Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xr9h-9m79-x29g.