CVE-2017-18353

Rendertron 1.0.0 includes an ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application...

CVE-2017-18353

Rendertron 1.0.0 exposes an unauthenticated HTTP GET endpoint at _ah/stop that shuts down the Chrome instance handling render requests. Several linked advisories (SUSe CVE entry, GHSA advisory, OSV/OSVDB) and CNVD entries confirm this route allows any unauthorized remote attacker to disable the c...