Gotenberg vulnerable to Server-side Request Forgery (SSRF) via /convert/html endpoint

CVE-2024-21527

What is CVE-2024-21527?

Multiple versions of the Gotenberg package prior to 8.1.0 contain a server-side request forgery (SSRF) vulnerability that can be exploited through the /convert/html endpoint. An attacker can issue a request to a file residing on localhost, leading to potential local file inclusion. This vulnerability allows unauthorized access to sensitive files on the host system. To mitigate this risk, users are advised to leverage the --chromium-deny-list and --chromium-allow-list flags.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References