Log in Start free

Vulnerability · Published Jul 19, 2024 · Assigned by snyk

CVE-2024-21527

High 8.2

In plain English

A high-severity server-side request forgery in github.com/gotenberg/gotenberg/v8/pkg/gotenberg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.6%top 52.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request is made to a file via localhost, such as <iframe src="\\localhost/etc/passwd">. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. Workaround An alternative is using either or both --chromium-deny-list and --chromium-allow-list flags.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/gotenberg/gotenberg/v7no fix listedGO-2024-2996
Gogithub.com/gotenberg/gotenberg/v88.1.0GO-2024-2996

Affected products (as reported)

VendorProductVersions
n/a github.com/gotenberg/gotenberg/v8/pkg/gotenberg 0 – before 8.1.0
n/a github.com/gotenberg/gotenberg/v8/pkg/modules/chromium 0 – before 8.1.0
n/a github.com/gotenberg/gotenberg/v8/pkg/modules/webhook 0 – before 8.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P

References