PT-2023-20005 · Stimulsoft · Stimulsoft Reporting Designer+1

Bsc + 4 · Published 2023-03-28 · Updated 2023-04-03 · CVE-2023-25262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Stimulsoft Designer (Web) version 2023.1.3

Description The issue allows an attacker to perform Server Side Request Forgery (SSRF) attacks. The Reporting Designer (Web) can embed sources from external locations, and when a user chooses such a location, the server performs the request, potentially causing outbound traffic and importing data. This behavior can be leveraged by an attacker to exfiltrate data from machines on the internal network of the server hosting the Stimulsoft Reporting Designer (Web).

Recommendations For version 2023.1.3, consider disabling the feature to embed sources from external locations as a temporary workaround until a patch is available. Restrict access to the Reporting Designer (Web) to minimize the risk of exploitation. Avoid using external locations for embedding sources in the affected version until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-25262

Affected Products

Stimulsoft Designer

Stimulsoft Reporting Designer

References · 6

• 🔥 https://cves.at/posts/cve-2023-25262/writeup · Exploit
• http://stimulsoft.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25262 · Security Note
• https://t.me/cvenotify/46951 · Telegram Post
• https://cloud-trustit.spp.at/s/HjEksN86SfsMaJM · Note