CVE-2020-13450
📋 TL;DR
CVE-2020-13450 is a critical directory traversal vulnerability in Gotenberg's file upload function that allows attackers to upload and overwrite files outside intended directories. This affects Gotenberg versions through 6.2.1 and can lead to denial of service, program behavior changes, or remote code execution. Organizations using vulnerable Gotenberg instances for document conversion services are at risk.
💻 Affected Systems
- Gotenberg
📦 What is this software?
Gotenberg by Thecodingmachine
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
File system corruption, denial of service, or unauthorized file modifications affecting application functionality.
If Mitigated
Limited impact with proper file permission restrictions and network segmentation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.2 and later
Vendor Advisory: https://github.com/thecodingmachine/gotenberg/issues/199
Restart Required: Yes
Instructions:
1. Stop Gotenberg service. 2. Update to version 6.2.2 or later. 3. Restart Gotenberg service. 4. Verify the fix by testing file upload functionality.
🔧 Temporary Workarounds
File Permission Restrictions
linuxSet strict file permissions on directories outside Gotenberg's intended upload folder
chmod 755 /path/to/restricted/directories
chown root:root /path/to/restricted/directories
Network Segmentation
linuxIsolate Gotenberg instances from critical systems using firewall rules
iptables -A INPUT -p tcp --dport 3000 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP
🧯 If You Can't Patch
- Disable file upload functionality entirely if not required
- Implement web application firewall (WAF) rules to block directory traversal patterns
🔍 How to Verify
Check if Vulnerable:
Check if Gotenberg version is 6.2.1 or earlier by examining the service version or container image tagCheck Version:
docker inspect gotenberg:tag | grep -i version OR check Gotenberg API endpoint /healthVerify Fix Applied:
Test file upload with directory traversal payloads (e.g., '../../etc/passwd') - should be rejected in patched versions📡 Detection & Monitoring
Log Indicators:
- File upload requests containing '../' sequences
- Unauthorized file write attempts outside upload directory
- Unexpected file modifications in system directories
Network Indicators:
- HTTP POST requests to upload endpoints with path traversal payloads
- Unusual outbound connections from Gotenberg instance
SIEM Query:
source="gotenberg" AND (http_method="POST" AND (url="*upload*" AND request_body="*../*"))🔗 References
- http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
- https://github.com/thecodingmachine/gotenberg/issues/199
- http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
- https://github.com/thecodingmachine/gotenberg/issues/199
