CVE-2024-21527 Server-side request forgery in github.com/gotenberg/gotenberg/v8/pkg/gotenberg
An attacker can exploit SSRF in the HTML conversion endpoint to read sensitive local files from the host system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21527?
CVE-2024-21527 is a high-severity server-side request forgery vulnerability in github.com/gotenberg/gotenberg/v8/pkg/gotenberg, published on 19 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endpoint when a request is made to a file via localhost, such as <iframe src="\\localhost/etc/passwd">. By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read on the host system. Workaround An alternative is using either or both --chromium-deny-list and --chromium-allow-list flags.
Weakness: CWE-918
Which versions are affected by CVE-2024-21527?
2 open source packages ship an affected version, including github.com/gotenberg/gotenberg/v7 and github.com/gotenberg/gotenberg/v8.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotenberg/gotenberg/v7 Go | All versions | None |
github.com/gotenberg/gotenberg/v8 Go | All versions | 8.1.0 |
How do I fix CVE-2024-21527?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-21527 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21527 exists.
Sources
Also known as GO-2024-2996.