Janek Vind has discovered two vulnerabilities in Calibre, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks.

1) Input passed via the URL is not properly verified before being used to display files in site-packages/calibre/library/server/content.py and can be exploited to disclose the contents of arbitrary files via directory traversal attacks and a trailing dot in the filename.

2) Input passed to the "query" parameter in browse/search is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Successful exploitation of these vulnerabilities requires the "Content Server" to be enabled (disabled by default).

The vulnerabilities are confirmed in version 0.7.34. Other versions may also be affected.

Solution
Restrict access to trusted users only. Filter malicious characters and character sequences in a proxy.

Provided and/or discovered by
Janek Vind

Original Advisory
http://www.waraxe.us/advisory-77.html

Deep Links
Links available in Customer Area