CVE-2020-28463 Server-side Request Forgery (SSRF)
An attacker can trigger Server-side Request Forgery in ReportLab by injecting malicious img tags into documents, allowing internal network access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28463?
CVE-2020-28463 is a medium-severity server-side request forgery vulnerability in Fedoraproject Fedora, published on 18 Feb 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
Weakness: CWE-918
Which versions are affected by CVE-2020-28463?
3 open source packages ship an affected version, including reportlab. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
reportlab PyPI | All versions | 3.5.55 |
reportlab PyPI | All versions | 3.5.55 |
reportlab PyPI | All versions | 3.5.55 |
Linux distribution packages (3)
python-reportlab SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 2.7-3.8.1 |
python-reportlab openSUSE:Leap 15.2 | All versions | 3.4.0-lp152.5.3.1 |
python-reportlab openSUSE:Leap 15.3 | All versions | 3.4.0-3.6.1 |
Products include Fedoraproject Fedora, Reportlab Reportlab.
How do I fix CVE-2020-28463?
Upgrade reportlab to 3.5.55 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-28463 being exploited?
There is no known exploitation of CVE-2020-28463 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-28463, GHSA-mpvw-25mg-59vx, MGASA-2021-0521, OESA-2022-1887, PYSEC-2021-146, SNYK-PYTHON-REPORTLAB-1022145 and 4 more.