Executive brief
jsreport is a reporting and document generation platform used to create and serve dynamic reports. The vulnerability allows attackers to bypass security controls via server-side request forgery (SSRF) and unintended code inclusion, enabling remote code execution on servers running vulnerable versions. This could allow attackers to compromise the reporting infrastructure, access sensitive data, or use the server for further attacks.
Technical details
jsreport versions 2.5.0 and earlier contain two related vulnerabilities: an unintended require mechanism that allows inclusion of arbitrary modules, and a server-side request forgery flaw (CWE-918). These vulnerabilities can be chained to achieve arbitrary code execution. The attack requires network access to the jsreport instance but does not require authentication or user interaction. An attacker can exploit these flaws to load malicious modules or trigger requests to internal systems, ultimately executing arbitrary code with the privileges of the jsreport process. The vendor patched these issues in version 2.6.0.
Affected products
- jsreport jsreport 2.5.0 and earlier
Timeline
- 2020-02-14: disclosed
- 2021-04-13: advisory
- 2020: patched: Fixed in version 2.6.0