ReportLab, a widely used Python library for converting HTML to PDF with approximately 3.5 million monthly downloads on PyPI, contains a critical vulnerability that enables the bypassing of sandbox restrictions. This write-up provides detailed insights into the discovery and exploitation of CVE-2023-33733 – a remote code execution (RCE) vulnerability in ReportLab. Given the library’s prevalence in applications that process PDF files, it is imperative to address and patch this vulnerability to prevent potential security breaches.
What is CVE-2023-33733?
CVE-2023-33733 refers to a security vulnerability that arises due to the ability to circumvent sandbox restrictions implemented on the ‘rl_safe_eval’ function. The purpose of this function is to prevent the execution of malicious code, and ReportLab introduced it as a patch in 2019 to address a previous RCE issue.
The exploit focuses on bypassing the rl_safe_eval function, as doing so would allow an attacker to gain access to Python built-in functions and execute remote code. The discovery of this bypass is particularly significant, considering the widespread use of the ReportLab library in various applications and tools.
ReportLab has been found to possess a previously patched vulnerability that allows code execution. This discovery of a potential bypass to the patch holds great interest from an attacker’s perspective, as it would lead to the rediscovery of code execution capabilities. It is worth noting that the ReportLab library is utilized not only in other applications and tools but also experienced a similar exploit in 2019. In that case, remote code execution was achieved through the Color attribute of HTML tags, which was directly evaluated as a Python expression using the eval function.
To mitigate this issue, ReportLab implemented a sandbox called rl_safe_eval, which removes dangerous Python built-in functions and overrides several others to allow the execution of safe code while preventing access to hazardous functions and libraries that could be used to construct malicious Python code. An example of such preventive measures involves overriding the builtin getattr function with a restricted function called rl_getitem, which restricts access to any dangerous attributes of objects. While the safe eval effectively sanitizes the environment by removing dangerous functions, discovering a bypass to these restrictions and gaining access to the original built-in functions would significantly facilitate the exploitation of the sandboxed environment.
One of the overridden built-in classes, named type, behaves differently based on the number of arguments it receives. If called with one argument, it returns the type of an object; however, if called with three arguments, it returns a new type object, effectively enabling the creation of a new class that inherits from another class. The idea behind the exploit is to create a new class, Word, that inherits from str and, when passed to the custom getattr, bypasses the checks, allowing access to sensitive attributes like __code__.
Does CVE-2023-33733 affect me?
Many apps and libraries use the ReportLab library. For instance, the xhtml2pdf utility function is vulnerable and can suffer a code execution while transforming malicious HTML to pdf. The widespread use of the library and the public exploit puts many users at risk. Software vendors using the library can address the resulting supply chain risk by applying the available security update.
Following his report, Cure53 researcher Elyas Damej told BleepingComputer that upon its discovery the issue was reported to ReportLab’s developers, and a fix came with version 3.6.13 released on April 27, 2023. Also important to note that the researcher clarified that the vulnerability impacts all earlier versions of the library.
Has CVE-2023-33733 been actively exploited in the wild?
A proof-of-concept (PoC) exploit showcasing the flaw CVE-2023-33733 has been shared on GitHub, accompanied by a detailed write-up explaining the technical aspects of the vulnerability. This release raises the likelihood of real-world exploitation of the flaw.
Exploiting CVE-2023-33733 involves a simple process of inserting malevolent code into an HTML file, which will subsequently be converted into a PDF using software utilizing the ReportLab library. The PoC demonstrates a method where the ‘type’ function is manipulated to create a new class called ‘Word,’ inheriting properties from the ‘str’ class. This manipulation permits the bypassing of safety checks and grants access to sensitive attributes such as ‘code.’
By utilizing ‘type’ on itself, the attacker can bypass evaluation checks that impose limits on the number of arguments. This facilitates the malicious use of the original built-in ‘type’ function to generate new classes and objects. Consequently, the attacker can construct a harmful function by employing the bytecode of a compiled one. When executed, this function can perform arbitrary actions. However, in order to exploit the vulnerability, the entire malicious code must be executed using ‘eval’ in a single expression.
The code is structured in this manner using the ‘list comprehension’ trick.
The process of exploiting CVE-2023-33733 is relatively straightforward as attackers can easily inject malicious code into an HTML file, which will subsequently undergo conversion to PDF using software reliant on the ReportLab library.
How to fix CVE-2023-3373
After being alerted by Damej, the developers of ReportLab were informed about the problem, and they promptly addressed it by incorporating a fix in version 3.6.13, which became available on April 27, 2023. It’s crucial to highlight that all earlier versions of the library are susceptible to this vulnerability.
Given the extensive adoption of ReportLab and the existence of a publicly available exploit, a considerable number of users are exposed to risks. To mitigate the potential supply chain risks associated with this issue, software vendors who rely on the library should apply the provided security update. It is recommended to promptly apply the provided security update to ensure the vulnerability is addressed and to protect against potential code injection and arbitrary code execution attacks.
Next steps
Each new vulnerability is a reminder of where we stand, and what we need to do better. Check out the following resources to help you maintain cyber hygiene and stay ahead of the threat actors:
- Can you trust ChatGPT’s package recommendations?
- MITRE ATTACK framework – Mapping techniques to CVEs
- Exploit maturity: an introduction
- OWASP Top 10 vulnerabilities 2022: what we learned
- How to fix CVE-2023-32784 in KeePass password manager
And finally…
Don’t get found out by new vulnerabilities. Vulcan Cyber gives you full visibility and oversight of your threat environment and lets you prioritize, remediate and communicate your cyber risk across your entire organization. Get a demo today.
