cbcvebase.
CVE-2020-5775
published 2020-08-21

CVE-2020-5775: Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to…

PriorityP278medium5.8CVSS 3.1
AVNACLPRNUINSCCNILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.53%
92.9th percentile
Server-Side Request Forgery in Canvas LMS 2020-07-29 allows a remote, unauthenticated attacker to cause the Canvas application to perform HTTP GET requests to arbitrary domains.

Affected

1 ranges
VendorProductVersion rangeFixed in
instructurecanvas_learning_management_service——

Detection & IOCsextracted from sources · hover to see the quote

url/external_content/retrieve/oembed?endpoint=http://{{interactsh-url}}&url=foo↗
  • →Detect SSRF exploitation attempts against Canvas LMS by monitoring HTTP GET requests to the /external_content/retrieve/oembed endpoint with an attacker-controlled 'endpoint' parameter pointing to an external/OOB host. ↗
  • →Confirm exploitation via out-of-band (OOB/OAST) HTTP interaction — a successful exploit causes Canvas to issue an outbound HTTP GET to the attacker-supplied endpoint value. ↗
  • →The vulnerability is exploitable by a remote, unauthenticated attacker — no authentication headers or session cookies are required in the triggering request. ↗
  • ·The vulnerable endpoint and query-string parameters are fixed: path must be /external_content/retrieve/oembed, with 'endpoint' carrying the SSRF target URL and 'url' set to any non-empty value (e.g. 'foo'). Both parameters must be present. ↗
  • ·This is a blind/OOB SSRF — there is no direct HTTP response reflection. Detection relies on observing the outbound callback from the Canvas server to the attacker-controlled endpoint, not on response content. ↗
  • ·Only the specific release dated 2020-07-29 of Canvas LMS (CPE: cpe:2.3:a:instructure:canvas_learning_management_service:2020-07-29) is confirmed affected per the advisory. ↗

CVSS provenance

nvdv3.15.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vulncheck5.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.