CVE-2023-46303
📋 TL;DR
This vulnerability in calibre's HTML conversion plugin allows Server-Side Request Forgery (SSRF) by default, enabling attackers to access resources outside the document root. It affects calibre users who convert HTML files to other formats. The vulnerability can lead to unauthorized file access and potential data exfiltration.
💻 Affected Systems
- calibre
📦 What is this software?
Calibre by Calibre Ebook
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive local files, internal network resources, or cloud metadata services, potentially leading to data theft, privilege escalation, or further network compromise.
Likely Case
Unauthorized access to local files on the calibre server, potentially exposing configuration files, credentials, or user data stored in accessible directories.
If Mitigated
Limited impact with proper network segmentation, file system permissions, and restricted calibre usage to trusted content only.
🎯 Exploit Status
Exploitation requires tricking a user into converting malicious HTML content. Public proof-of-concept demonstrates SSRF via img tags.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.19.0 and later
Vendor Advisory: https://github.com/kovidgoyal/calibre/compare/v6.18.1...v6.19.0
Restart Required: No
Instructions:
1. Update calibre to version 6.19.0 or later using your package manager or calibre's built-in updater. 2. For Linux: Use apt-get upgrade calibre or equivalent. 3. For Windows/macOS: Download latest version from calibre-ebook.com.
🔧 Temporary Workarounds
Disable HTML conversion
allTemporarily disable HTML file conversion in calibre until patched
Restrict file system access
linuxRun calibre with minimal file system permissions using sandboxing or containerization
firejail calibre
docker run --read-only -v /safe/path:/data calibre
🧯 If You Can't Patch
- Only convert HTML files from trusted sources
- Run calibre in isolated environment with restricted network and file access
🔍 How to Verify
Check if Vulnerable:
Check calibre version: calibre --version. If version is below 6.19.0, system is vulnerable.Check Version:
calibre --versionVerify Fix Applied:
After updating, verify version is 6.19.0 or higher: calibre --version📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from calibre process
- Conversion attempts with external URLs in HTML content
Network Indicators:
- calibre process making unexpected network requests to internal resources
SIEM Query:
process_name:"calibre" AND (event_type:"file_access" OR dest_ip:private_ip_range)