BentoPDF versions 2.8.6 and earlier include a CORS proxy implemented in cloudflare/cors-proxy-worker.js that validates supplied hostnames using isPrivateOrReservedHost() before DNS resolution. However, the DNS resolution used by fetch(targetUrl) can resolve the hostname to internal or reserved IP addresses after validation, enabling SSRF attacks. The proxy allows response bodies up to 10 MB to be relayed. Deployments without PROXY_SECRET skip signature checks intended as anti-abuse measures but do not prevent SSRF. Both the official Worker deployment and self-hosted instances are affected if the Worker environment can reach internal or reserved destinations. The vulnerability is addressed in BentoPDF 2.8.7.

An attacker can exploit this SSRF vulnerability to make the proxy server send requests to internal or reserved network destinations that are normally inaccessible externally. This can lead to unauthorized access to internal services, data exposure, or other impacts depending on the internal resources reachable. The vulnerability has a high CVSS score of 8.6, indicating significant confidentiality and availability impact, with partial integrity impact.

A fixed version, BentoPDF 2.8.7, is available and should be applied to remediate this vulnerability. Since this is a cloud service, the vendor manages remediation for the official Worker deployment. For self-hosted instances, upgrading to 2.8.7 or later is required. Deployments should also ensure PROXY_SECRET is configured to enable signature checks as an anti-abuse measure. No additional mitigation steps are indicated in the advisory.