CVE-2015-8748: Radicale Regex Bypass Vulnerability

Background

Radicale is an open-source CalDAV and CardDAV server written in Python. It provides a simple and lightweight solution for hosting calendars and address books. The vulnerability in Radicale versions before 1.1 allows remote authenticated users to bypass owner_write and owner_only limitations by exploiting regex metacharacters in the user name. This vulnerability can lead to unauthorized access and potential data manipulation.

Vulnerability Detail

The vulnerability arises from a lack of proper input validation in the user name field. By using regex metacharacters such as ".*", an authenticated user can bypass the owner_write and owner_only restrictions. This allows them to perform actions that should be restricted to the owner of the resource. The impact of this vulnerability depends on the specific permissions and actions allowed by the Radicale server.

pip install --upgrade "radicale==3.8.3"

pip install --upgrade "radicale==4bfe7c9f7991d534c8b9fbe153af9d341f925f98"

Workaround

As a temporary workaround, users can manually validate and sanitize the user name input to prevent the use of regex metacharacters. This can be done by implementing a validation function that checks for the presence of regex metacharacters and rejects the input if found. Here is an example in Python:

import re

def validate_username(username):
    if re.search(r'[.*]', username):
        raise ValueError('Invalid username')

# Usage
username = input('Enter username: ')
validate_username(username)

This code snippet checks if the username contains any regex metacharacters and raises a ValueError if found.

Conclusion

The Radicale Regex Bypass vulnerability (CVE-2015-8748) allows authenticated users to bypass owner_write and owner_only restrictions, potentially leading to unauthorized access and data manipulation. To mitigate this vulnerability, it is recommended to upgrade Radicale to version 1.1 or later. Alternatively, you can implement a temporary workaround by manually validating and sanitizing the user name input to prevent the use of regex metacharacters. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for radicale →

FAQ