CVE-2023-0100 Improper Input Validation In Eclipse BIRT

What is CVE-2023-0100?

CVE-2023-0100 is a high-severity server-side request forgery vulnerability in The Eclipse Foundation Eclipse BIRT (Business Intelligence Reporting Tool), published on 15 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.

Weakness: CWE-20

Which versions are affected by CVE-2023-0100?

2 open source packages ship an affected version, including org.eclipse.birt:org.eclipse.birt.report.viewer. It affects 1 product.

Products include Eclipse Business Intelligence and Reporting Tools.

How do I fix CVE-2023-0100?

Upgrade org.eclipse.birt:org.eclipse.birt.report.viewer to 4.13 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-0100 being exploited?

There is no known exploitation of CVE-2023-0100 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse BIRT (Business Intelligence Reporting Tool)

• CVE-2021-34427 File upload in Eclipse BIRT Critical 9.8
• CVE-2019-11776 Cross-site scripting in Eclipse BIRT Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4grc-q4fj-45p8.