All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->     odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img     src=http://127.0.0.1:5000 valign=top/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF     (CVE-2020-28463)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In
    order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to
    reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->
    odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img
    src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py
    6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
    (CVE-2020-28463)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3590 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3590-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     September 29, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-reportlab     Version        : 3.5.13-1+deb10u2     CVE ID         : CVE-2019-19450 CVE-2020-28463

    Security issues were discovered in python-reportlab, a Python library     for generating PDFs and graphics, which could lead to remote code     execution or authorization bypass.

    CVE-2019-19450

        Ravi Prakash Giri discovered a remote code execution vulnerability         via crafted XML document where <unichar code= is followed by         arbitrary Python code.

        This issue is similar to CVE-2019-17626.

    CVE-2020-28463

        Karan Bamal discovered a Server-side Request Forgery (SSRF)         vulnerability via <img> tags.  New settings trustedSchemes and         trustedHosts have been added as part of the fix/mitigation: they         can be used to specify an explicit allowlist for remote sources.

    For Debian 10 buster, these problems have been fixed in version     3.5.13-1+deb10u2.

    We recommend that you upgrade your python-reportlab packages.

    For the detailed security status of python-reportlab please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-reportlab

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:3209-1 advisory.

    - CVE-2020-28463: Fixed Server-side Request Forgery via img tags (bsc#1182503).
    - Add missing import in CVE-2020-28463 fix (bsc#1190110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1147-1 advisory.    - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject  4. Create a nc listener nc
-lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.     dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF (CVE-2020-28463)  Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2641-1 advisory.    - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject  4. Create a nc listener nc
-lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.     dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF (CVE-2020-28463)  Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

ID	Name	Product	Family	Severity
223513	Linux Distros Unpatched Vulnerability : CVE-2020-28463	Nessus	Misc.	medium
417068	SCA: security update for reportlab (GHSA-mpvw-25mg-59vx)	Tenable Cloud Security	SCA Checks	high
417068	SCA: security update for reportlab (GHSA-mpvw-25mg-59vx)	Tenable Self-Hosted Container Security	SCA Checks	high
182381	Debian dla-3590 : python-renderpm - security update	Nessus	Debian Local Security Checks	critical
153614	SUSE SLED12 / SLES12 Security Update : python-reportlab (SUSE-SU-2021:3209-1)	Nessus	SuSE Local Security Checks	high
152563	openSUSE 15 Security Update : python-reportlab (openSUSE-SU-2021:1147-1)	Nessus	SuSE Local Security Checks	medium
152393	openSUSE 15 Security Update : python-reportlab (openSUSE-SU-2021:2641-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-28463

high

Tenable Plugins

medium

high

high

critical

high

medium

medium