CVE-2019-18345

Vulnerability

The vulnerability is a reflected cross-site scripting (XSS) issue in DAViCal through version 1.1.8 [2]. It occurs because the application echoes the action parameter without proper encoding or sanitization. An attacker can craft a malicious URL containing JavaScript in the action parameter, which is then executed in the context of the victim's browser when the victim visits that URL. No special configuration is required beyond having a vulnerable version of DAViCal installed.

Exploitation

To exploit this vulnerability, an attacker must trick a legitimate DAViCal user into clicking a crafted link containing the malicious payload in the action parameter. The victim must be authenticated to the DAViCal instance for the attack to succeed. No additional privileges are required for the attacker; the attack is carried out by social engineering or by embedding the link in a trusted context. Once the victim clicks the link, the attacker's JavaScript executes in the victim's session.

Impact

Successful exploitation allows the attacker to perform any action that the victim user can perform, and view any data that the victim user can view. If the victim is an administrator, the attacker can, for example, add a new admin user, thereby gaining full control over the DAViCal application [1]. The compromise directly affects confidentiality, integrity, and availability of the calendar data and administrative functions.

Mitigation

The vulnerability is present in DAViCal version 1.1.8 and earlier. According to the DAViCal wiki, the current stable release is 1.1.13 [2]; users should upgrade to version 1.1.13 or later, which contains the fix. If upgrading is not possible, ensure that users do not click untrusted links and consider applying a web application firewall rule to filter malicious action parameter input. No official workaround has been provided for unpatched versions.