Other nomination
Exploiting dynamic rendering engines to take control of web apps
Dynamic rendering services such as Rendertron and Prerender run a headless browser server-side for crawlers, and the URL it fetches is attacker-controlled through a spoofed crawler User-Agent or an open redirect. That gives SSRF to cloud metadata, and chained render and screenshot calls exfiltrate the token, leading to takeover of the host application.
Record
- Published by
- r2c
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of r2c, first published at the original source. Preserved copies are kept so the citation survives its host.