S-Senhaji

**Name of the Vulnerable Software and Affected Versions** Gotenberg versions prior to 8.31.0 **Description** An unauthenticated remote attacker can achieve OS command execution via the '/forms/pdfengines/metadata/write' endpoint. The application accepts a JSON metadata object and passes its keys to ExifTool without validating for control characters. By embedding a newline character (` `) within a JSON key, an attacker can split the input stream to inject arbitrary ExifTool flags. Specifically, the `-if` flag can be used to evaluate Perl expressions, leading to arbitrary code execution. The attack is transparent to basic monitoring as the server returns an HTTP 200 response with a valid PDF. **Recommendations** Update to version 8.31.0. As a temporary mitigation, restrict access to the '/forms/pdfengines/metadata/write' endpoint or place the service behind an authenticated reverse proxy to prevent untrusted access to port 3000.

**Name of the Vulnerable Software and Affected Versions** Gotenberg versions 8.29.1 through 8.30.x **Description** An unauthenticated attacker with network access can force the server to make outbound HTTP POST requests to arbitrary internal or external destinations. This is achieved by supplying a crafted URL in the `Gotenberg-Webhook-Url` request header. The issue stems from the `FilterDeadline()` function in `filter.go`, which is intended to gate outbound URLs but returns nil unconditionally when both the allow-list and deny-list are empty (the default configuration), thereby permitting any URL. This is a blind Server-Side Request Forgery (SSRF), meaning the server does not return the target's response body to the attacker. However, an attacker can probe internal network infrastructure by observing whether the error callback is invoked, force POST requests against internal services that perform side effects, and confirm the reachability of cloud metadata endpoints. The impact is amplified by a retryable HTTP client that issues up to 4 automatic retries per request. **Recommendations** Update to version 8.31.0. As a temporary workaround, configure the `GOTENBERG API WEBHOOK ALLOW LIST` environment variable to restrict webhook URLs to known receivers. As a temporary workaround, set `GOTENBERG API WEBHOOK DENY LIST` to block RFC-1918 and link-local address ranges.