CVE-2020-28463
SSRF in Reportlab via img tags
- CVSS 6.5
- CWE-918 Server-Side Request Forgery (SSRF)
- Configuration Issues
- Remote
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
- CVSS base score
- 6.5
- Published
- 2021-02-18
- OWASP
- A10 Server Side Request Forgery (SSRF)
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Configuration Issues
- Subcategory
- Server-Side Request Forgery (SSRF)
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update Reportlab to a version with a fix for SSRF vulnerability.
Vulnerable code sample
from reportlab.pdfgen import canvas
def create_pdf(output_filename, img_url):
c = canvas.Canvas(output_filename)
c.drawString(100, 750, "Hello, ReportLab!")
c.drawImage(img_url, 100, 600)
c.save()
create_pdf("output.pdf", "http://127.0.0.1:5000/image.png")Patched code sample
from reportlab.pdfgen import canvas
import os
import requests
from urllib.parse import urlparse
import io
import ipaddress
import socket
def check_remote_url(url):
parsed = urlparse(url)
if parsed.scheme not in ('http', 'https'):
return False
try:
hostname = parsed.hostname
ip = socket.gethostbyname(hostname)
ip_obj = ipaddress.ip_address(ip)
if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local:
return False
except Exception:
return False
return True
def create_pdf(output_filename, img_source):
c = canvas.Canvas(output_filename)
c.drawString(100, 750, "Hello, ReportLab!")
if os.path.isfile(img_source):
c.drawImage(img_source, 100, 600)
elif check_remote_url(img_source):
resp = requests.get(img_source, timeout=5)
if resp.status_code == 200 and 'image' in resp.headers.get('Content-Type', ''):
image_stream = io.BytesIO(resp.content)
c.drawImage(image_stream, 100, 600)
else:
raise ValueError("Remote resource is not a valid image")
else:
raise ValueError("Invalid image source")
c.save()
create_pdf("output.pdf", "https://example.com/image.png")Cite this entry
@misc{vaitp:cve202028463,
title = {{SSRF in Reportlab via img tags}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2021},
note = {VAITP Python Vulnerability Dataset, entry CVE-2020-28463},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-28463/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::