Security readout for executives and security teams
Plain-English summary
Gotenberg’s HTML conversion endpoint may fetch local or internal resources referenced by submitted HTML. If an exposed service accepts untrusted HTML, an attacker could cause it to read limited internal information. The sources describe confidentiality impact only, not data modification, service outage, or confirmed exploitation.
Executive priority
Treat this as a moderate confidentiality risk. Prioritize review if Gotenberg processes user-supplied HTML, is internet-accessible, or runs near sensitive internal files or services. It is less urgent for isolated, trusted-only conversion pipelines.
Technical view
CVE-2021-23345 affects github.com/thecodingmachine/gotenberg. The /convert/html endpoint dereferences HTML src attributes and can access internal system files or resources, creating SSRF-style exposure. CVSS 3.1 is 5.3: network reachable, low complexity, no privileges, no user interaction, unchanged scope, and low confidentiality impact.
Likely exposure
Organizations are most exposed where Gotenberg is reachable by untrusted users or upstream applications pass user-controlled HTML into /convert/html. Internal-only deployments still matter if other applications can submit attacker-influenced conversion jobs.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The vulnerability appears practical when an attacker can control HTML submitted for conversion, but evidence here is limited to the public CVE, Snyk advisory, and GitHub issue.
Researcher notes
The source bundle identifies all versions of github.com/thecodingmachine/gotenberg as affected, but does not provide a specific fixed version or named patch. Avoid assuming remediation beyond vendor guidance and compensating controls. No CWE is listed in the provided record.
Mitigation direction
- Check current Gotenberg vendor guidance and advisory history before choosing a fix.
- Restrict access to /convert/html to trusted internal callers only.
- Avoid submitting untrusted HTML to Gotenberg without server-side sanitization.
- Block conversion workers from reaching sensitive internal file paths and networks.
- Add monitoring for conversion requests referencing local or internal resources.
Validation and detection
- Inventory services using github.com/thecodingmachine/gotenberg or exposed Gotenberg containers.
- Identify routes or applications that forward user-controlled HTML to /convert/html.
- Review access controls around Gotenberg endpoints, especially internet-facing paths.
- Check logs for conversion jobs referencing local files or internal resource locations.
- Confirm network egress restrictions for Gotenberg conversion workers.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Cloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-23345 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMTHECODINGMACHINEGOTENBERG-1062043CVE reference · x_refsource_MISC
- https://github.com/thecodingmachine/gotenberg/issues/261CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.