PT-2020-6960 · Reportlab+2 · Reportlab+2
Karan Bamal
·
Published
2020-10-27
·
Updated
2023-09-29
·
CVE-2020-28463
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
reportlab versions prior to the version with the fix
Description
The issue is related to Server-side Request Forgery (SSRF) via img tags. It allows a remote attacker to access confidential data due to insufficient request validation. To reduce the risk, using trustedSchemes and trustedHosts as specified in Reportlab's documentation is recommended. The vulnerability can be exploited by injecting an img tag with a malicious src attribute into a text file that is converted to PDF. This can be demonstrated by following specific steps, including downloading and installing the latest package of reportlab, injecting a malicious img tag into a text file, and creating a netcat listener to capture the server-side request.
Recommendations
To resolve the issue, use trustedSchemes and trustedHosts as specified in Reportlab's documentation for all versions of reportlab prior to the version with the fix.
As a temporary workaround, consider restricting the use of img tags in reportlab until a patch is available.
Avoid using untrusted sources for img tags in reportlab to minimize the risk of exploitation.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Suse
Reportlab