CVE-2020-28463

{"id": "CVE-2020-28463", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2021-02-18T16:15:12.707", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html", "source": "report@snyk.io"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/", "source": "report@snyk.io"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/", "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145", "tags": ["Exploit", "Release Notes", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://www.reportlab.com/docs/reportlab-userguide.pdf", "tags": ["Product", "Vendor Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF"}, {"lang": "es", "value": "Todas las versiones del paquete reportlab son vulnerables a un ataque de tipo Server-side Request Forgery (SSRF) por medio de etiquetas img.&#xa0;Para reducir el riesgo, utilice TrustSchemes y TrustHosts (consulte la documentaci\u00f3n de Reportlab). Pasos para reproducir por Karan Bamal: 1. Descargue e instale el \u00faltimo paquete de reportlab 2. Vaya a demos -) odyssey -) dodyssey 3. En el archivo de texto odyssey.txt que necesita ser convertido a pdf inyecte (img src=\"http://127.0.0.1:5000\" valign= top\" /) 4. Cree un oyente nc nc -lp 5000 5. Ejecute python3 dodyssey.py 6. Recibir\u00e1 un resultado en su nc que muestra que hemos procedido con \u00e9xito a enviar una petici\u00f3n del lado del servidor 7. dodyssey.py mostrar\u00e1 un error ya que no contiene un archivo img en la URL, pero somos capaces de hacer un ataque de tipo SSRF"}], "lastModified": "2023-11-07T03:21:22.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:reportlab:reportlab:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96329C58-2A30-4D2E-A421-B7FF3BC6CF55"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}