CVE-2020-27998 Missing Authorization in FastReport
FastReport library lacks script security, allowing attackers to execute arbitrary code via unsafe reflection and dynamic loading functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27998?
CVE-2020-27998 is a critical code injection vulnerability in n/a, published on 29 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, DllImport, LoadLibrary, and GetProcAddress.
Weakness: CWE-862
Which versions are affected by CVE-2020-27998?
2 open source packages ship an affected version, including FastReport.OpenSource. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
FastReport.OpenSource NuGet | All versions | 2020.4.0 |
FastReport.OpenSource NuGet | All versions | 2020.4.0 |
Products include Fast-Report Fastreport.
How do I fix CVE-2020-27998?
Upgrade FastReport.OpenSource to 2020.4.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-27998 being exploited?
There is no known exploitation of CVE-2020-27998 in the wild and no public exploit code.
Sources
Also known as GHSA-v726-3vg9-cp34.