Server-side Request Forgery (SSRF) Vulnerability in ReportLab Package
Summary
CVE-2020-28463: All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. Affects python-reportlab versions < 3.5.55-1. Fixed in 3.5.55-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ReportLab is a widely used open-source library for generating PDFs in Python. It allows developers to create complex documents programmatically, offering features such as text, images, and graphics rendering. However, all versions of ReportLab are susceptible to a Server-side Request Forgery (SSRF) vulnerability, which can lead to unauthorized access to internal services.
Vulnerability Detail
The SSRF vulnerability in ReportLab arises from its handling of <img> tags in documents. An attacker can exploit this by injecting a malicious <img> tag that points to a local server, allowing them to send requests to internal services that should not be accessible externally. This can lead to data leakage, unauthorized access, or further exploitation of the internal network. The vulnerability is present in all versions of the package and can be reproduced by following specific steps outlined in the vulnerability report.
How To Fix
Minimum fixed version
3.5.55-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-reportlabTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure the trustedSchemes and trustedHosts settings in ReportLab's configuration to restrict the sources from which images can be loaded. This can help mitigate the risk of SSRF until an upgrade is performed. Refer to the ReportLab documentation for detailed instructions on setting these configurations.
Conclusion
The SSRF vulnerability in ReportLab poses significant risks to applications using this library. It is crucial to upgrade to the latest version to mitigate these risks. Additionally, implementing trustedSchemes and trustedHosts settings can provide an extra layer of security while the upgrade is pending.
See every vulnerability recorded for python-reportlab →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts can include data leakage, unauthorized access to internal services, and the potential for further exploitation of the internal network.
Yes, upgrading to version 3.5.55-1 or later will mitigate the SSRF vulnerability.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-reportlab.
