SB2021010601 - Multiple vulnerabilities in Gotenberg
Published: January 6, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Template Injection (CVE-ID: CVE-2020-13449)
The vulnerability allows a remote attacker to read contents of arbitrary files on the system.
The vulnerability exists due to improper input validation when converting data into PDF format via "/convert/markdown" URL. A remote attacker can pass specially crafted file and read contents of arbitrary files on the system via PDF output.
2) Arbitrary file upload (CVE-ID: CVE-2020-13450)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload at the "/convert/markdown" URL. A remote attacker can upload a malicious file and execute it on the server.
3) Incomplete cleanup (CVE-ID: CVE-2020-13451)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to software does not remove temporary files created during previous file uploads. A remote attacker can upload a specially crafted file that will overwrite libreoffice config (profile) files and execute arbitrary code on the system using libreoffice macros.
4) Incorrect default permissions (CVE-ID: CVE-2020-13452)
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to incorrect default permissions for the "/tini" file, which is writable by default by the gotenberg user. A remote attacker can overwrite the file using vulnerability #VU49284 and perform a denial of service attack or execute arbitrary code on the system.
Remediation
Install update from vendor's website.