Summary:
Reportlab is a Python library for generating PDF documents and creating charts and data graphics in different formats, including PDF, bitmap, and vector. A researcher found a working exploit for a remote code execution (RCE) vulnerability in ReportLab Toolkit, identified as CVE-2023-33733. The vulnerability affects all versions prior to 3.6.13 of the library. ReportLab Toolkit, a widely utilized PDF library, boasts around 3.5 million monthly downloads on PyPI and is employed by numerous projects.[/subscribe_to_unlock_form]
Summary:
Reportlab is a Python library for generating PDF documents and creating charts and data graphics in different formats, including PDF, bitmap, and vector. A researcher found a working exploit for a remote code execution (RCE) vulnerability in ReportLab Toolkit, identified as CVE-2023-33733. The vulnerability affects all versions prior to 3.6.13 of the library. ReportLab Toolkit, a widely utilized PDF library, boasts around 3.5 million monthly downloads on PyPI and is employed by numerous projects.[emaillocker id="1283"]
The issue arises from the ability to circumvent sandbox restrictions on 'rl_safe_eval,' which is designed to prevent the execution of malicious code. This allows attackers to gain access to potentially harmful Python built-in functions. The 'rl_safe_eval' function was initially implemented to mitigate a previous remote code execution vulnerability identified in 2019. However, the researcher's focus was on finding a way to bypass this function. It utilizes 'type' to create a new class called 'Word' that inherits from the 'str' class. By doing so, the PoC bypasses safety checks and gains access to sensitive attributes such as 'code.' Furthermore, it invokes 'type' on itself to bypass safe eval checks related to argument count restrictions. This enables the attacker to exploit the original built-in 'type' function to create new classes and objects as desired. This process involves constructing a malicious function using the bytecode of a compiled function. When executed, this function can carry out arbitrary actions. To ensure the exploit code runs as a single expression with eval, the researcher utilizes a technique known as "list comprehension" to structure the code.
Researchers have cautioned that exploiting CVE-2023-33733 is straightforward, involving the inclusion of malicious code within an HTML file that will be converted to PDF using software utilizing the ReportLab library. Due to the library's extensive usage and the existence of a public exploit, numerous users are at risk. To mitigate the resulting supply chain risk, software vendors utilizing the library should promptly apply the available security update.
Recommendations:
References:
The following reports contain further technical details:
[/emaillocker]