Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Reportlab Package Allows Hackers to Access Internal Servers

CVE-2020-28463 · published 5 years ago
Summary

Old versions of Reportlab, a tool used to generate PDFs, can be exploited to allow hackers to access internal servers. This means that sensitive information could be stolen or used to launch further attacks. To protect yourself, update to the latest version of Reportlab and follow the recommended security settings to limit who can be accessed.

What to do
  • Update andy robinson reportlab to version 3.5.55.
Affected software
Ecosystem VendorProductAffected versions
pip andy robinson reportlab < 3.5.55
Fix: upgrade to 3.5.55
– reportlab reportlab All versions
cpe:2.3:a:reportlab:reportlab:*:*:*:*:*:*:*:*
– fedoraproject fedora 34
35
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Original advisory text
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) St...
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.1 High
Exploitation
1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published18 Feb 2021
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mpvw-25mg-59vx · GHSA
CVE-2020-28463 · NVD
Track software like this
Free during beta