PT-2022-11683 · Stimulsoft · Stimulsoft Reports

Burninator · Published 2022-10-29 · Updated 2022-11-01 · CVE-2021-42777

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stimulsoft (aka Stimulsoft Reports) version 2013.1.1600.0

Description The issue allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine. This is demonstrated by the use of System.Diagnostics.Process.Start.

Recommendations For Stimulsoft (aka Stimulsoft Reports) version 2013.1.1600.0, consider disabling the Compilation Mode as a temporary workaround until a patch is available. Restrict access to sensitive reports and machines to minimize the risk of exploitation. Avoid using the System.Diagnostics.Process.Start function in reports until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2021-42777

Affected Products

Stimulsoft Reports

References · 4

• 🔥 http://burninatorsec.blogspot.com/2022/04/library-rce-object-chaining-cve-2021.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42777 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42777 · Vendor Advisory
• https://t.me/cibsecurity/52267 · Telegram Post