A critical Server-Side Request Forgery (SSRF) vulnerability in Gotenberg allows unauthenticated attackers to potentially access internal network resources.

This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). It allows an unauthenticated, remote attacker to manipulate the application into sending requests to unintended destinations, potentially exposing internal services.

Successful exploitation of this SSRF vulnerability can lead to unauthorized access to internal services or sensitive data that are not exposed to the public internet. Given the CVSS score of 7.5, this is a High severity issue that could facilitate lateral movement within the network, potentially compromising the confidentiality of backend systems.

Immediate Action: Update the Gotenberg Docker container to version 8.34.0 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at internal IP addresses or sensitive API endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious outbound requests or unexpected URL patterns originating from the Gotenberg service.

Public Exploit Available: Unknown

The vulnerability presents a significant risk to internal infrastructure security. Administrators must prioritize updating to version 8.34.0 to mitigate the SSRF risk and prevent potential unauthorized access to sensitive internal network segments.