# Title
Blind SSRF via URL fetch
# Summary
`calibre-web` allows external URL fetching in order to upload a book cover. However, instead of external URL it is possible to point to localhost, which will be reached resulting in blind SSRF.
# Steps to reproduce
1. 1\. As an admin give permissions to upload files and edit books to any staff.
2. 2\. As an admin run any server on localhost to see the SSRF.
3. 3\. As a malicious staff go to books section -> select any book -> edit metadata -> in the `Fetch Cover from URL` field specify the address of service that you ran as an admin -> save the book.
4. 4\. As an admin observe that service on localhost was reached.
# PoC:
As a service for PoC I used python simple server - `python -m http.server 1234`.
Also you may tunnel `calibre-web` server using `ngrok` - `ngrok http 1234` - to prove that it is exploitable in real environment (I already did, just wanted to make video PoC as short as possible).
[Video PoC](https://www.youtube.com/watch?v=qU3IJme84Mg)
# Impact
This vulnerability is capable of port scanning and even may execute some actions on victim's side in case there are sensitive services on localhost.
{"id": "499688C4-6AC4-4047-A868-7922C3EAB369", "vendorId": null, "type": "huntr", "bulletinFamily": "bugbounty", "title": "Server-Side Request Forgery (SSRF) in janeczku/calibre-web", "description": "# Title\nBlind SSRF via URL fetch\n\n# Summary\n`calibre-web` allows external URL fetching in order to upload a book cover. However, instead of external URL it is possible to point to localhost, which will be reached resulting in blind SSRF.\n\n # Steps to reproduce\n1. 1\\. As an admin give permissions to upload files and edit books to any staff.\n2. 2\\. As an admin run any server on localhost to see the SSRF.\n3. 3\\. As a malicious staff go to books section -> select any book -> edit metadata -> in the `Fetch Cover from URL` field specify the address of service that you ran as an admin -> save the book.\n4. 4\\. As an admin observe that service on localhost was reached.\n\n# PoC:\nAs a service for PoC I used python simple server - `python -m http.server 1234`.\nAlso you may tunnel `calibre-web` server using `ngrok` - `ngrok http 1234` - to prove that it is exploitable in real environment (I already did, just wanted to make video PoC as short as possible).\n[Video PoC](https://www.youtube.com/watch?v=qU3IJme84Mg)\n\n# Impact\nThis vulnerability is capable of port scanning and even may execute some actions on victim's side in case there are sensitive services on localhost.", "published": "2021-12-20T11:47:34", "modified": "2022-01-22T16:12:37", "epss": [{"cve": "CVE-2022-0339", "epss": 0.00194, "percentile": 0.56991, "modified": "2023-10-30"}], "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "baseScore": 7.5}, "severity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://www.huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369/", "reporter": "scara31", "references": ["https://portswigger.net/web-security/ssrf/blind"], "cvelist": ["CVE-2022-0339"], "immutableFields": [], "lastseen": "2023-10-30T15:23:05", "viewCount": 105, "enchantments": {"score": {"value": -0.2, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2022-0339"]}, {"type": "github", "idList": ["GHSA-2647-C639-QV2J", "GHSA-4W8P-X6G8-FV64"]}, {"type": "osv", "idList": ["OSV:GHSA-2647-C639-QV2J", "OSV:GHSA-4W8P-X6G8-FV64", "OSV:PYSEC-2022-23"]}, {"type": "prion", "idList": ["PRION:CVE-2022-0339"]}, {"type": "veracode", "idList": ["VERACODE:33972"]}]}, "epss": [{"cve": "CVE-2022-0339", "epss": 0.00157, "percentile": 0.50682, "modified": "2023-05-02"}], "vulnersScore": -0.2}, "_state": {"score": 1698844884, "dependencies": 1698683655, "epss": 0}, "_internal": {"score_hash": "8ab9381a0916379f223a8ddb0d05f2e0"}, "status": "valid", "cwe_id": "918", "repository": "https://github.com/janeczku/calibre-web", "language": "JavaScript", "patch_commit_sha": "3b216bfa07ec7992eff03e55d61732af6df9bb92"}
Server-Side Request Forgery (SSRF) in janeczku/calibre-web
