CVE-2023-33733
High · 7.8CVSS
7.8
EPSS
2.1%
Published
Jun 5, 2023
CISA due date
—
Cloudanix analysis
A widely used PDF tool can let attackers take over computers simply by getting a specially made PDF file processed on the system.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Full Compromise
- Component
- Library
- Class
- RCE
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Allows arbitrary code execution when Reportlab processes a specially crafted PDF file due to insufficient input validation in PDF parsing routines.
Why it matters to the business
Attackers can gain full control of systems that generate or read PDFs using this library, risking data theft, ransomware deployment, or service disruption; the flaw has been public with working exploits for over three years and affects any downstream application relying on Reportlab.
How an attack unfolds
An attacker crafts a malicious PDF that triggers the code-execution flaw during parsing, then delivers the file to a target application or user that invokes Reportlab; once processed, the embedded payload runs arbitrary commands on the host.
How to fix it
Upgrade Reportlab to the latest available version that resolves the PDF parsing issue; where an upgrade is not immediately possible, isolate PDF processing to dedicated sandboxed environments and restrict untrusted file sources.
How to confirm the fix worked
Inventory all Reportlab installations and verify versions exceed 3.6.12; test PDF handling workflows with known-safe and known-malicious sample files in a controlled environment to confirm the flaw is no longer triggered.
Typical attack path
- Identify applications that use Reportlab to handle PDFs
- Craft a malicious PDF exploiting the parsing flaw
- Deliver the PDF via email, web upload, or file share
- Trigger PDF processing in Reportlab
- Execute attacker-supplied code on the target system
How to detect it
Review application and system logs for unexpected process creation or errors during PDF handling; examine file-access and process-creation events around Reportlab execution for anomalies indicating payload execution.
What your security team should do
- Immediately inventory Reportlab usage across all applications and services
- Prioritize upgrade of Reportlab in any internet-facing or high-value systems
- Implement sandboxing or containerization for PDF processing workflows
- Add PDF file-type restrictions and scanning in email and upload paths
The record
Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | reportlab | 0 | 3.6.13 |
| Debian:11 | python-reportlab | 0 | No fix |
| Debian:11 | python-reportlab | 0 | 3.5.59-2+deb11u1 |
| Debian:12 | python-reportlab | 0 | No fix |
| Debian:12 | python-reportlab | 0 | 3.6.12-1+deb12u1 |
| Debian:13 | python-reportlab | 0 | 3.6.13-1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP4 | python-reportlab | 0 | 3.4.0-150000.3.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP5 | python-reportlab | 0 | 3.4.0-150000.3.9.1 |
| SUSE:Linux Enterprise Workstation Extension 12 SP5 | python-reportlab | 0 | 2.7-3.13.1 |
| Ubuntu:16.04:LTS | python-reportlab | 0 | No fix |
| Ubuntu:18.04:LTS | python-reportlab | 0 | No fix |
| Ubuntu:20.04:LTS | python-reportlab | 0 | 3.5.34-1ubuntu1.1 |
| Ubuntu:22.04:LTS | python-reportlab | 0 | 3.6.8-1ubuntu0.1 |
| Ubuntu:Pro:16.04:LTS | python-reportlab | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | python-reportlab | 0 | No fix |
| openSUSE:Leap 15.4 | python-reportlab | 0 | 3.4.0-150000.3.9.1 |
| openSUSE:Leap 15.5 | python-reportlab | 0 | 3.4.0-150000.3.9.1 |