rendertron can remotely shut down Chrome instance · CVE-2017-18353 · GitHub Advisory Database · GitHub

rendertron can remotely shut down Chrome instance

High severity GitHub Reviewed Published Jan 4, 2019 to the GitHub Advisory Database • Updated Sep 6, 2023

Package

rendertron (npm)

Affected versions

< 1.1.0

Patched versions

1.1.0

Description

Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.

References

Published to the GitHub Advisory Database Jan 4, 2019

Reviewed Jun 16, 2020

Last updated Sep 6, 2023

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H