Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Gotenberg allows for unauthenticated operating system command execution. An attacker can send a specially crafted HTTP request to the /forms/pdfengines/metadata/write endpoint, bypassing security checks and running arbitrary commands on the server. This is a critical issue because it can lead to a complete compromise of the affected system.
- Remote attackers can execute commands.
- The attack is transparent to basic monitoring.
- It affects Gotenberg versions prior to 8.31.0.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can achieve remote code execution by sending a specially crafted JSON payload to the /forms/pdfengines/metadata/write endpoint. This payload leverages the lack of validation on JSON keys, allowing a newline character to inject arbitrary ExifTool commands, including those that execute Perl expressions. The attack is stealthy as it results in a successful HTTP 200 response and a valid PDF.
- Targetting HTTP metadata endpoint
- Unauthenticated network access
- No input validation on keys
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Gotenberg's metadata writing endpoint presents a clear path for unauthenticated remote command execution. Attackers can exploit this by injecting newline characters into JSON keys, which are then passed directly to ExifTool, allowing for arbitrary flag execution. The vulnerability's critical rating and the nature of the exploit—a single HTTP request leading to OS command execution with a seemingly valid PDF response—make it highly attractive.
- Unauthenticated remote code execution
- No public exploit code observed
- Recent published vulnerability
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediately isolating or taking offline any Gotenberg instances running versions prior to 8.31.0, as this critical vulnerability allows unauthenticated remote code execution. The attack is undetectable by basic monitoring due to the valid PDF response.
- Apply Gotenberg version 8.31.0 or later.
- Block network traffic to the affected endpoint.
- Monitor for suspicious command execution.
