CVE-2022-0766: Server-Side Request Forgery in calibreweb

Background

calibreweb is a Python package available on PyPI that provides a web interface for managing and accessing an ebook library. It allows users to browse, search, and download ebooks from their calibre library. The package is widely used by individuals and organizations to organize and access their ebook collections. However, calibreweb versions prior to 0.6.17 are vulnerable to a server-side request forgery (SSRF) attack.

Vulnerability Detail

The vulnerability in calibreweb is due to an incomplete fix for CVE-2022-0339. The blacklist implemented to prevent SSRF attacks does not check for the IP address 0.0.0.0, which can be used as a payload to resolve to localhost. An attacker can exploit this vulnerability to make unauthorized requests to internal resources, potentially leading to information disclosure, remote code execution, or other malicious activities.

pip install --upgrade "calibreweb==0.6.27"

pip install --upgrade "calibreweb==0.6.17"

Workaround

If upgrading to the latest version is not immediately possible, users can implement a temporary workaround by manually modifying the source code. Specifically, the calibreweb.cps.helper.save_cover_from_url function should be updated to include a check for the IP address 0.0.0.0 and reject any requests containing this address. Here is an example of the modified code:

# Original code
def save_cover_from_url(url):
    # Existing code
    
    # Modified code
    if url == '0.0.0.0':
        raise ValueError('Invalid URL')
    
    # Existing code
    
    # Modified code
    
    return cover_path

Please note that this workaround is not a permanent solution and should be replaced with the official fix as soon as possible.

Conclusion

In conclusion, calibreweb versions prior to 0.6.17 are vulnerable to a server-side request forgery (SSRF) attack. This vulnerability can be exploited to make unauthorized requests to internal resources, potentially leading to serious consequences. Users are strongly advised to upgrade to calibreweb version 0.6.17 or later to mitigate this vulnerability. If immediate upgrade is not possible, a temporary workaround can be implemented by modifying the source code. For further assistance and support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for calibreweb →

FAQ