CVE-2019-18345
📋 TL;DR
CVE-2019-18345 is a reflected cross-site scripting (XSS) vulnerability in DAViCal CalDAV server that allows attackers to execute arbitrary JavaScript in victims' browsers. By tricking users into clicking malicious links, attackers can perform actions as the victim user, including viewing all accessible data and performing administrative functions. All DAViCal users through version 1.1.8 are affected.
💻 Affected Systems
- DAViCal CalDAV Server
📦 What is this software?
Davical by Davical
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the DAViCal instance where an attacker gains administrative privileges, creates new admin accounts, accesses all calendar data, and performs any action available to administrators.
Likely Case
Attackers steal session cookies or authentication tokens to hijack user sessions, access sensitive calendar data, and perform unauthorized actions as compromised users.
If Mitigated
Limited impact with proper input validation and output encoding, though the vulnerability still exists in unpatched systems.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but the technical complexity is low with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.1.8
Vendor Advisory: https://gitlab.com/davical-project/davical/blob/master/ChangeLog
Restart Required: Yes
Instructions:
1. Backup your DAViCal installation and database. 2. Download and install the latest DAViCal version from the official repository. 3. Restart the web server (Apache/Nginx). 4. Verify the installation is working correctly.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block requests containing malicious script patterns in the action parameter
# Example ModSecurity rule: SecRule ARGS:action "@rx <script" "id:1001,phase:2,deny,status:403,msg:'XSS Attack Detected'"
Input Validation Filter
linuxAdd custom input validation to sanitize the action parameter before processing
# PHP example: $action = htmlspecialchars($_GET['action'], ENT_QUOTES, 'UTF-8');
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution from untrusted sources
- Deploy a reverse proxy with XSS filtering capabilities in front of the DAViCal server
🔍 How to Verify
Check if Vulnerable:
Test by accessing a URL with a simple XSS payload in the action parameter: https://your-davical-server/davical.php?action=<script>alert('XSS')</script>Check Version:
grep '\$c->dbg\["version"\]' /path/to/davical/inc/always.php | head -1Verify Fix Applied:
After patching, test the same XSS payload - it should be properly encoded and not execute JavaScript📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing script tags or JavaScript in the action parameter
- Unusual administrative actions from non-admin IP addresses
- Multiple failed login attempts followed by successful login from different IP
Network Indicators:
- HTTP requests with encoded script payloads in query parameters
- Traffic patterns showing users accessing unusual URLs with long parameter values
SIEM Query:
source="web_logs" AND (uri="*action=*script*" OR uri="*action=*javascript:*" OR uri="*action=*onload=*")🔗 References
- http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html
- https://gitlab.com/davical-project/davical/blob/master/ChangeLog
- https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
- https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
- https://seclists.org/bugtraq/2019/Dec/30
- https://wiki.davical.org/index.php/Main_Page
- https://www.davical.org/
- https://www.debian.org/security/2019/dsa-4582
- http://packetstormsecurity.com/files/155630/DAViCal-CalDAV-Server-1.1.8-Reflective-Cross-Site-Scripting.html
- https://gitlab.com/davical-project/davical/blob/master/ChangeLog
- https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability/
- https://lists.debian.org/debian-lts-announce/2019/12/msg00016.html
- https://seclists.org/bugtraq/2019/Dec/30
- https://wiki.davical.org/index.php/Main_Page
- https://www.davical.org/
- https://www.debian.org/security/2019/dsa-4582
