PT-2023-20005 · Stimulsoft · Stimulsoft Reporting Designer+1

Bsc + 4 · Publicado 2023-03-28 · Atualizado 2023-04-03 · CVE-2023-25262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stimulsoft Designer (Web) version 2023.1.3

Description The issue allows an attacker to perform Server Side Request Forgery (SSRF) attacks. The Reporting Designer (Web) can embed sources from external locations, and when a user chooses such a location, the server performs the request, potentially causing outbound traffic and importing data. This behavior can be leveraged by an attacker to exfiltrate data from machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).

Recommendations For version 2023.1.3, consider disabling the feature to embed sources from external locations as a temporary workaround until a patch is available. Restrict access to the Reporting Designer (Web) to minimize the risk of exploitation. Avoid using external locations for embedding sources in the affected version until the issue is resolved.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-25262

Produtos afetados

Stimulsoft Designer

Stimulsoft Reporting Designer

Referências · 6

• 🔥 https://cves.at/posts/cve-2023-25262/writeup · Exploit
• http://stimulsoft.com · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25262 · Aviso do Fabricante
• https://t.me/cvenotify/46951 · Publicação no Telegram
• https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25262 · Nota de Segurança