Vulnerability · Published Feb 18, 2021 · Assigned by snyk
CVE-2020-28463Server-side Request Forgery (SSRF)
Medium 6.5
In plain English
A medium-severity security flaw in reportlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-reportlab | 3.5.55-1 | DEBIAN-CVE-2020-28463 |
| Debian:13 | python-reportlab | 3.5.55-1 | DEBIAN-CVE-2020-28463 |
| Debian:14 | python-reportlab | 3.5.55-1 | DEBIAN-CVE-2020-28463 |
| PyPI | reportlab | 3.5.55 | GHSA-mpvw-25mg-59vx |
| PyPI | reportlab | 3.5.55 | PYSEC-2021-146 |