CVE-2022-0339
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in calibre-web versions prior to 0.6.16. Attackers can exploit this to make the server send arbitrary HTTP requests to internal systems, potentially accessing sensitive data or services. All users running vulnerable versions of calibre-web are affected.
💻 Affected Systems
- calibre-web
📦 What is this software?
Calibre Web by Janeczku
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network services, data exfiltration from internal systems, and potential lateral movement to other critical infrastructure.
Likely Case
Unauthorized access to internal HTTP services, metadata harvesting from internal endpoints, and potential credential theft from internal APIs.
If Mitigated
Limited to port scanning of internal services if proper network segmentation and egress filtering are implemented.
🎯 Exploit Status
Exploitation requires authenticated access to the calibre-web interface. The fix commit shows the vulnerability was in URL validation logic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.16
Vendor Advisory: https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92
Restart Required: Yes
Instructions:
1. Backup your current calibre-web installation and database. 2. Stop the calibre-web service. 3. Update to version 0.6.16 or later using pip: 'pip install --upgrade calibreweb'. 4. Restart the calibre-web service. 5. Verify the version is 0.6.16 or higher.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict calibre-web server's outbound network access to only necessary services
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
Authentication Hardening
allImplement strong authentication requirements and limit user privileges
🧯 If You Can't Patch
- Implement strict network egress filtering to block all outbound HTTP/HTTPS traffic from the calibre-web server
- Place calibre-web behind a reverse proxy with strict URL validation and request filtering
🔍 How to Verify
Check if Vulnerable:
Check if calibre-web version is below 0.6.16. The vulnerability exists in all versions prior to this.Check Version:
pip show calibreweb | grep VersionVerify Fix Applied:
Verify the installed version is 0.6.16 or higher and test that SSRF attempts are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from calibre-web server
- Requests to internal IP addresses or localhost from calibre-web
Network Indicators:
- HTTP traffic from calibre-web server to unexpected internal services
- Port scanning patterns originating from calibre-web server
SIEM Query:
source="calibre-web" AND (dest_ip=10.0.0.0/8 OR dest_ip=172.16.0.0/12 OR dest_ip=192.168.0.0/16 OR dest_ip=127.0.0.0/8)🔗 References
- https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92
- https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369
- https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92
- https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369
