ReportLab up to 3.5.26 colors.py toColor XML Document xml injection

Summaryinfo

A vulnerability was found in ReportLab up to 3.5.26. It has been classified as critical. This affects the function toColor of the file colors.py. The manipulation with the input <span color=" as part of XML Document leads to xml injection. This vulnerability is traded as CVE-2019-17626. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ReportLab up to 3.5.26 (Reporting Software) and classified as critical. This issue affects the function toColor of the file colors.py. The manipulation with the input value <span color=" leads to a xml injection vulnerability. Using CWE to declare the problem leads to CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

The weakness was shared 10/16/2019. The identification of this vulnerability is CVE-2019-17626 since 10/16/2019. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 236756 (Alibaba Cloud Linux 3 : 0130: python-reportlab (ALINUX3-SA-2023:0130)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (236756). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Reporting Software

Name

• ReportLab

Version

• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.5.4
• 3.5.5
• 3.5.6
• 3.5.7
• 3.5.8
• 3.5.9
• 3.5.10
• 3.5.11
• 3.5.12
• 3.5.13
• 3.5.14
• 3.5.15
• 3.5.16
• 3.5.17
• 3.5.18
• 3.5.19
• 3.5.20
• 3.5.21
• 3.5.22
• 3.5.23
• 3.5.24
• 3.5.25
• 3.5.26

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion