Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated attacker can trick Gotenberg into accessing internal services by bypassing download and webhook filters. This allows an attacker to force the server to make outbound requests to internal-only targets, potentially exposing sensitive systems.
- Allows access to internal services.
- Forces outbound requests.
- Affects servers processing external input.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw to force Gotenberg to make HTTP requests to internal services. By crafting specific URLs that bypass the default deny-list, an attacker can target internal APIs or databases, potentially leading to data exfiltration or service disruption.
- Unauthenticated network access.
- Bypass URL deny-list filter.
- Target internal HTTP services.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Gotenberg is likely to be weaponized by attackers due to its critical severity and the common use case of the software. The ability for an unauthenticated attacker to bypass deny-lists and force the server to make requests to internal services presents a significant opportunity for data exfiltration or further network compromise. Observed threat intelligence does not yet indicate active exploitation.
- Bypass of URL filtering
- Unauthenticated remote code execution possible
- Fix available in 8.31.0
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking access to Gotenberg instances if they are exposed externally and running a version prior to 8.31.0, as this critical vulnerability allows unauthenticated attackers to bypass URL filters and access internal services. Review logs for evidence of attempted or successful exploitation, specifically looking for unusual outbound connection attempts from the Gotenberg server.
- Update Gotenberg to version 8.31.0.
- Isolate affected Gotenberg instances from the network.
- Monitor network traffic for suspicious outbound requests.
