All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-reportlab: Server-side request forgery via img tags (CVE-2020-28463)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3590 advisory.

  - ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as     demonstrated by a crafted XML document with '<span color=' followed by arbitrary Python code.
    (CVE-2019-17626)

  - paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py     evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code='     followed by arbitrary Python code, a similar issue to CVE-2019-17626. (CVE-2019-19450)

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->     odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img     src=http://127.0.0.1:5000 valign=top/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF     (CVE-2020-28463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:3209-1 advisory.

  - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos ->     odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img     src=http://127.0.0.1:5000 valign=top/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.
    dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF     (CVE-2020-28463)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1147-1 advisory.    - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject  4. Create a nc listener nc
-lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.     dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF (CVE-2020-28463)  Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:2641-1 advisory.    - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In     order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to     reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject  4. Create a nc listener nc
-lp 5000 5. Run python3 dodyssey.py     6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7.     dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF (CVE-2020-28463)  Note that Nessus has not tested for this issue but has instead relied only on the application's self- reported version number.

ID	Name	Product	Family	Severity
199904	RHEL 8 : quay_quay-rhel8 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
196055	RHEL 7 : python-reportlab (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
196040	RHEL 6 : python-reportlab (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
182381	Debian DLA-3590-1 : python-reportlab - LTS security update	Nessus	Debian Local Security Checks	critical
153614	SUSE SLED12 / SLES12 Security Update : python-reportlab (SUSE-SU-2021:3209-1)	Nessus	SuSE Local Security Checks	medium
152563	openSUSE 15 Security Update : python-reportlab (openSUSE-SU-2021:1147-1)	Nessus	SuSE Local Security Checks	medium
152393	openSUSE 15 Security Update : python-reportlab (openSUSE-SU-2021:2641-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-28463

medium

Tenable Plugins

medium

medium

critical

critical

medium

medium

medium