Author: Janek Vind "waraxe"
Date: 20. December 2010
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-77.html
Affected Software:
Calibre is a free and open source e-book library management application developed
by users of e-books for users of e-books. It has a cornucopia of features divided
into the following main categories: Library Management, E-book conversion, Syncing
to e-book reader devices, Downloading news from the web and converting it into
e-book form, Comprehensive e-book viewer, Content server for online access to your
book collection
http://calibre-ebook.com/
Affected versions
Tests were conducted against Calibre version 0.7.34 for Windows, older versions
may be vulnerable as well. Other platform versions were not tested.
###############################################################################
Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: specially crafted HTTP GET request
Preconditions:
1. Calibre Content Server must be turned on (off by default)
2. If Username and Password set, they must be known (no password by default)
Impact: remote attacker can read arbitrary files on the target system
So, I was interested in e-book management software and after some research found
Calibre. It has useful feature - Content Server. Basically it's Webserver, based
on CherryPy, written in Python. As specialized in Web Application Security, then
obviously I spent some time playing with it.
I used Firefox with Live HTTP Headers Add-On, which provides easy way to observe
HTTP requests and responses. This is what got my attention:
http://localhost:8080/static/browse/browse.css
http://localhost:8080/static/jquery_ui/css/humanity-custom/jquery-ui-1.8.5.custom.css
http://localhost:8080/static/jquery.multiselect.css
Seems like accessing static resources. Norhing unusual. But what if …
http://localhost:8080/static/browse/waraxe
500 Internal Server Error
The server encountered an unexpected condition which prevented it from fulfilling
the request.
Traceback (most recent call last):
File "site-packages\cherrypy\_cprequest.py", line 606, in respond
File "site-packages\cherrypy\_cpdispatch.py", line 25, in call
File "site-packages\calibre\library\server\utils.py", line 51, in do
File "site-packages\calibre\library\server\content.py", line 98, in static
KeyError: u'browse/waraxe'
As seen above, no checks for dot-dot-slash (…/), so Directory Traversal
vulnerability may exist.
Quick look at Calibre install directory revealed the fact, that static
resources folder is located here:
C:\Program Files (x86)\Calibre2\resources\content_server\
Let's see, if we can fetch files outside of that directory:
http://localhost:8080/static/../jquery.simulate.js
I was testing it with Firefox 3.6.13 and Live HTTP Headers revealed problem:
GET /jquery.simulate.js HTTP/1.1
500 Internal Server Error
The server encountered an unexpected condition which prevented it from fulfilling
the request.
By the way, that trick with trailing dot or space character(s) is based on
Win32 API features. I tried it in php and python, in both cases we can open same
file with paths "waraxe.txt", "waraxe.txt.", "waraxe.txt ", "waraxe.txt. . .".
I tried Win32 API CreateFile() from C code and it worked in same way.
Seems like useful trick :)
###############################################################################
2. Reflected XSS Vulnerability in Calibre Content Server
###############################################################################
Reason: failure to sufficiently sanitize user-supplied input data
Attack vector: user-supplied GET parameter "query"
Preconditions:
1. Calibre Content Server must be turned on (off by default)
2. If Username and Password set, they must be known (no password by default)
Example attack:
Disclosure Timeline:
20.12.2010 Developer contacted via email
20.12.2010 Developer gave green light for going public
20.12.2010 Public disclosure
Greetings:
Greets to ToXiC, y3dips, Sm0ke, Heintz, slimjim100, pexli, zerobytes, vince213333,
to all active waraxe.us forum members and to anyone else who know me!
Contact:
come2waraxe@yahoo.com
Janek Vind "waraxe"
Waraxe forum: http://www.waraxe.us/forums.html
Personal homepage: http://www.janekvind.com/
Random project: http://errorhelpdesk.com/
---------------------------------- [ EOF ] ------------------------------------