CVE-2024-7008: Calibre-ebook Calibre XSS Vulnerability

CVE-2024-7008 Overview

CVE-2024-7008 is a reflected cross-site scripting (XSS) vulnerability in Calibre, the open-source e-book management application maintained by Kovid Goyal. Versions up to and including 7.15.0 fail to sanitize user-supplied input in the legacy book URL handler of the Calibre content server. An attacker can craft a malicious URL that, when visited by an authenticated user, executes arbitrary JavaScript in the context of the Calibre web interface. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session hijacking, library manipulation, and theft of credentials or e-book metadata from users accessing the Calibre content server over the network.

Affected Products

Calibre <= 7.15.0 (content server component)
Calibre e-book management application distributed by calibre-ebook
Deployments exposing the Calibre content server via /book/ legacy redirect endpoint

Discovery Timeline

2024-08-06 - CVE-2024-7008 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database
Vendor patch committed to the Calibre repository in commit 863abac2 referenced by the Star Labs Security Advisory

Technical Details for CVE-2024-7008

Vulnerability Analysis

The vulnerability resides in src/calibre/srv/legacy.py within the Calibre content server. The legacy handler accepts a path beginning with book/ and constructs a client-side redirect URL that embeds the remainder of the path directly into the response HTML. Because the remainder is not validated as a numeric book identifier, an attacker can inject arbitrary characters, including HTML and JavaScript, into the generated page. A victim who clicks a crafted link triggers reflected script execution in their browser. The attack succeeds against any user who can reach the Calibre content server, including local-network and internet-exposed deployments.

Root Cause

The root cause is missing input validation on the trailing path segment after book/. The handler expects a numeric book ID but accepts arbitrary strings and concatenates them into an HTML fragment without encoding. The patch casts the segment to int(), forcing a type error on non-numeric input and preventing injection.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted URL pointing to a vulnerable Calibre content server. When the victim loads the link, the server reflects the attacker-controlled payload into the HTML response, executing JavaScript in the victim's session context.

python

# Patch applied in src/calibre/srv/legacy.py
 if rest.startswith('book/'):
     # implementation of https://bugs.launchpad.net/calibre/+bug/1698411
     # redirect old server book URLs to new URLs
-    redirect = ctx.url_for(None) + '#book_id=' + rest[5:] + "&panel=book_details"
+    redirect = ctx.url_for(None) + '#book_id=' + int(rest[5:]) + "&panel=book_details"
     from lxml import etree as ET
     return html(ctx, rd, endpoint,
              E.html(E.head(

Source: Calibre GitHub Commit 863abac2. The fix wraps rest[5:] in int(), ensuring only integer book identifiers reach the response template.

Detection Methods for CVE-2024-7008

Indicators of Compromise

HTTP requests to the Calibre content server where the path matches /book/ followed by non-numeric characters, HTML tags, or URL-encoded script content.
Server access logs containing %3Cscript, onerror=, or javascript: tokens in URIs targeting the /book/ endpoint.
Outbound browser traffic from internal users to attacker-controlled domains shortly after visiting a Calibre URL.

Detection Strategies

Deploy web application firewall rules that block or alert on non-integer values following /book/ in Calibre content server traffic.
Correlate reverse-proxy or NGINX logs with endpoint telemetry to identify users who loaded suspicious Calibre URLs.
Hunt for Calibre process versions <= 7.15.0 across managed hosts and flag content servers listening on reachable interfaces.

Monitoring Recommendations

Monitor the Calibre content server port (default 8080) for anomalous query strings and oversized URIs.
Alert on browser referrers originating from external URL shorteners landing on internal Calibre endpoints.
Track EPSS trends for this CVE; the current EPSS percentile places exploitation probability in the upper tier of monitored vulnerabilities.

How to Mitigate CVE-2024-7008

Immediate Actions Required

Upgrade Calibre to a version later than 7.15.0 that includes commit 863abac2.
Restrict access to the Calibre content server using network ACLs, VPN, or reverse-proxy authentication.
Advise users not to click untrusted links referencing the Calibre content server until the patch is applied.

Patch Information

The vendor fix is published in the Calibre GitHub repository. The patch coerces the book identifier segment to an integer in src/calibre/srv/legacy.py, blocking reflected injection into the redirect page. Administrators should rebuild or redeploy Calibre from a release that incorporates this commit.

Workarounds

Place the Calibre content server behind a reverse proxy that strips or rejects requests to /book/<non-integer> paths.
Disable the legacy /book/ redirect endpoint if it is not required by downstream clients.
Enforce a strict Content Security Policy on the reverse proxy to limit inline script execution originating from reflected payloads.

bash

# Example NGINX rule to block non-numeric /book/ paths before they reach Calibre
location ~ ^/book/ {
    if ($uri !~ ^/book/[0-9]+/?$) {
        return 400;
    }
    proxy_pass http://127.0.0.1:8080;
}