CVE-2020-13452
📋 TL;DR
CVE-2020-13452 is an insecure permissions vulnerability in Gotenberg where the tini process manager file is writable by the gotenberg user, allowing attackers to overwrite it. This can lead to denial of service or remote code execution. Affects Gotenberg deployments through version 6.2.1.
💻 Affected Systems
- Gotenberg
📦 What is this software?
Gotenberg by Thecodingmachine
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution as the gotenberg user, potentially leading to privilege escalation and complete control of the host system.
Likely Case
Denial of service by overwriting tini to crash the service, or limited code execution within the gotenberg user context to access sensitive documents and system resources.
If Mitigated
Minimal impact if proper file permissions and container isolation are implemented, limiting the attack surface to service disruption only.
🎯 Exploit Status
Exploitation requires initial access to execute commands as the gotenberg user, but the file overwrite itself is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.0 and later
Vendor Advisory: https://github.com/thecodingmachine/gotenberg/issues/199
Restart Required: Yes
Instructions:
1. Update Gotenberg to version 6.3.0 or later. 2. Pull the latest Docker image: docker pull thecodingmachine/gotenberg:6.3.0. 3. Restart your Gotenberg containers with the updated image.
🔧 Temporary Workarounds
Fix tini permissions
linuxManually set proper permissions on the tini binary to prevent overwrites
chmod 755 /usr/local/bin/tini
chown root:root /usr/local/bin/tini
🧯 If You Can't Patch
- Implement strict container isolation with read-only filesystems where possible
- Restrict network access to Gotenberg instances and monitor for suspicious file modification attempts
🔍 How to Verify
Check if Vulnerable:
Check if tini file is writable by gotenberg user: docker exec <container> ls -la /usr/local/bin/tini | grep 'rw' for gotenbergCheck Version:
docker exec <container> gotenberg --versionVerify Fix Applied:
Verify tini permissions show root ownership and no write access for gotenberg: docker exec <container> ls -la /usr/local/bin/tini📡 Detection & Monitoring
Log Indicators:
- Unexpected file modification events on /usr/local/bin/tini
- Gotenberg service crashes or restarts
Network Indicators:
- Unusual outbound connections from Gotenberg containers
SIEM Query:
source="docker" AND (event="file_modification" AND file_path="/usr/local/bin/tini") OR (process="gotenberg" AND event="crash")🔗 References
- http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
- https://github.com/thecodingmachine/gotenberg/issues/199
- http://packetstormsecurity.com/files/160744/Gotenberg-6.2.0-Traversal-Code-Execution-Insecure-Permissions.html
- https://github.com/thecodingmachine/gotenberg/issues/199
