CVE-2024-6781: Calibre-ebook Path Traversal Vulnerability

CVE-2024-6781 Overview

CVE-2024-6781 is a path traversal vulnerability affecting Calibre e-book management software versions 7.14.0 and earlier. This vulnerability allows unauthenticated remote attackers to read arbitrary files on the affected system by manipulating file path parameters. Path traversal attacks exploit insufficient input validation to access files and directories outside the intended scope.

Critical Impact

Unauthenticated attackers can achieve arbitrary file read on systems running vulnerable versions of Calibre's content server, potentially exposing sensitive configuration files, credentials, and other confidential data.

Affected Products

• Calibre-ebook Calibre versions up to and including 7.14.0

Discovery Timeline

• August 6, 2024 - CVE-2024-6781 published to NVD
• August 19, 2024 - Last updated in NVD database

Technical Details for CVE-2024-6781

Vulnerability Analysis

This path traversal vulnerability (CWE-22) exists in Calibre's content server component, which allows users to share their e-book libraries over a network. The vulnerability stems from inadequate sanitization of user-supplied file path inputs. When Calibre's content server processes requests for files, it fails to properly validate and restrict path components, enabling attackers to use directory traversal sequences (such as ../) to escape the intended directory and access files elsewhere on the file system.

The network-accessible nature of this vulnerability is particularly concerning as it requires no authentication, meaning any attacker with network access to the Calibre content server can exploit this flaw. The vulnerability affects confidentiality by allowing unauthorized read access to sensitive files, though it does not impact system integrity or availability.

Root Cause

The root cause of CVE-2024-6781 is improper input validation in the file path handling logic of Calibre's content server. The application does not adequately sanitize or restrict user-controlled path inputs, allowing directory traversal sequences to be processed. This enables attackers to construct malicious requests that navigate outside the intended directory structure and access arbitrary files readable by the Calibre process.

Attack Vector

The attack is conducted remotely over the network without requiring authentication. An attacker targets the Calibre content server by sending specially crafted HTTP requests containing directory traversal sequences in file path parameters. By manipulating these parameters with sequences like ../, the attacker can traverse the directory structure and read files outside the designated content directory.

For example, an attacker could craft requests to access sensitive system files such as /etc/passwd on Linux systems or configuration files containing credentials. The attack requires only network connectivity to the vulnerable Calibre content server instance.

Detection Methods for CVE-2024-6781

Indicators of Compromise

• HTTP request logs containing directory traversal sequences such as ../, ..%2f, or URL-encoded variants targeting the Calibre content server
• Unusual file access patterns or read operations on sensitive system files by the Calibre process
• Network traffic to Calibre content server ports containing path manipulation attempts
• Log entries showing access attempts to files outside the normal e-book library directories

Detection Strategies

• Monitor web server and application logs for requests containing path traversal patterns (../, ..\\, encoded variants)
• Implement intrusion detection system (IDS) rules to detect directory traversal attempts in HTTP traffic
• Deploy web application firewall (WAF) rules to block requests containing suspicious path sequences
• Audit file access logs for the Calibre process accessing files outside its designated library directories

Monitoring Recommendations

• Enable verbose logging on Calibre content server to capture all incoming requests
• Set up alerts for any HTTP 200 responses to requests containing traversal sequences
• Monitor system file access for unexpected reads by the Calibre application user
• Implement network traffic analysis to identify potential exploitation attempts targeting your Calibre instances

How to Mitigate CVE-2024-6781

Immediate Actions Required

• Upgrade Calibre to version 7.15.0 or later immediately
• If upgrading is not immediately possible, disable the Calibre content server feature until patched
• Restrict network access to the Calibre content server to trusted networks only using firewall rules
• Review logs for any signs of prior exploitation attempts

Patch Information

The vulnerability has been addressed by the Calibre development team. The fix is available in the GitHub commit bcd0ab12c41a887f8290a9b56e46c3a29038d9c4. Users should update to Calibre version 7.15.0 or later to receive this security fix. Additional technical details about the vulnerability can be found in the StarLabs Security Advisory #24-6781.

Workarounds

• Disable the Calibre content server functionality if it is not required for your use case
• Place the Calibre content server behind a reverse proxy with path traversal filtering enabled
• Use firewall rules to restrict access to the content server port to only trusted IP addresses
• Run Calibre with minimal file system permissions to limit the impact of successful exploitation

# Configuration example - Restrict Calibre content server access via iptables
# Allow only trusted network (192.168.1.0/24) to access Calibre server port
iptables -A INPUT -p tcp --dport 8080 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP