Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's downloadFrom feature and webhook feature are bypassable. Because the filter is regex-based and case-sensitive, an unauthenticated attacker can supply URLs such as http://[::ffff:127.0.0.1]:... and reach loopback or private HTTP services that the default deny-list is intended to block. This crosses a real security boundary because an external caller can force the server to make outbound requests to internal-only targets. This vulnerability is fixed in 8.31.0.
The URL address filtering mechanism in the downloadFrom and webhook functions is based on regular expressions (regex) with case-sensitive matching. An attacker can provide a URL in IPv6-mapped IPv4 format, e.g. http://[::ffff:127.0.0.1]:..., which is not recognized by the regex as a loopback or private address. As a result, the deny-list intended to block access to local and private addresses is effectively bypassed. The server then executes an outgoing HTTP request to the internal target specified by the attacker.
An unauthenticated attacker can force the Gotenberg server to execute requests to internal network services (SSRF), potentially gaining access to sensitive data and the ability to interact with internal infrastructure unavailable from the outside.
Gotenberg should be updated to version 8.31.0 or newer, in which the vulnerability has been fixed. Additionally, it is recommended to restrict outgoing traffic from the Gotenberg container at the network level (firewall, network policies in containerized environments).
Gotenberg in versions prior to 8.31.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LThecodingmachine Gotenberg
APPThecodingmachine< 8.31.0
Related vulnerabilities
Gotenberg: command injection w endpoincie zapisu metadanych PDF via ExifTool
Gotenberg: injection w wartościach metadanych — zapis plików i symlinki
RCE w Gotenberg — nadpisanie konfiguracji LibreOffice przez makra
Path Traversal w Gotenberg umożliwia nadpisanie plików i RCE
Gotenberg: nieprawidłowe uprawnienia do pliku tini umożliwiają RCE lub DoS