CVE-2019-18346

Vulnerability

DAViCal [1] through version 1.1.8 is vulnerable to Cross-Site Request Forgery (CSRF). The application does not implement CSRF tokens or other anti-CSRF mechanisms, allowing an attacker to forge requests on behalf of an authenticated user. The vulnerability is present in all versions up to and including 1.1.8.

Exploitation

An attacker must trick an authenticated DAViCal user into visiting a malicious webpage or link. The attacker can then send arbitrary HTTP requests to the DAViCal application, including requests to modify settings or create users. If the victim has administrative privileges, the attacker can create new admin accounts, effectively compromising the entire installation.

Impact

Successful exploitation allows the attacker to perform any action that the victim user is authorized to do. For an administrator, this includes user management, calendar modifications, and privilege escalation. The confidentiality, integrity, and availability of the DAViCal application can be fully compromised.

Mitigation

No official fix or patch has been released by the vendor as of the publication date. Users should avoid accessing untrusted websites while logged into DAViCal, and consider implementing additional CSRF protection at the network level. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.