CVE-2019-18347

Vulnerability

DAViCal versions through 1.1.8 are affected by a stored cross-site scripting (XSS) issue. The application fails to adequately sanitize output of fields set by unprivileged users, specifically the Username, Display Name, and Email database fields. This allows JavaScript stored in those fields to be executed when viewed by another user, including a privileged user [1].

Exploitation

An attacker needs network access to the DAViCal instance and the ability to create or modify their own account or user profile. By setting one of the vulnerable fields (Username, Display Name, or Email) to contain malicious JavaScript, the payload will be stored in the database. When a privileged user views the attacker's profile or list, the script executes in their browser context.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to information disclosure (e.g., session cookies, CSRF tokens), unauthorized actions on behalf of the privileged user, or further compromise of the DAViCal instance.

Mitigation

The DAViCal project has not released a patched version as of the publication date (2019-12-04). Users are advised to upgrade to the latest version when available, or implement input validation and output escaping via a web application firewall (WAF) or custom code changes.