Calibre Web 0.6.24 Blind Command Injection Vulnerability (CVE-2021-39585) Analysis and POC

Key Information Summary Vulnerability Overview Vulnerability Name: Calibre Web 0.6.24 - Blind Command Injection CVE ID: CVE-2021-39585 CVSS Score: 7.5 (High) Discovery Date: 2021-08-25 Affected Versions: 0.6.24 and earlier Fixed Version: Not provided Vulnerability Description A blind command injection vulnerability exists in Calibre Web version 0.6.24. Attackers can execute arbitrary commands on the target system by crafting malicious requests. Vulnerability Details Vulnerability Type: Blind Command Injection Impact Scope: Attackers can exploit this vulnerability to execute arbitrary commands on affected systems, potentially leading to full system compromise. Exploitation Conditions: Attackers must be able to send specific HTTP requests to the affected Calibre Web server. POC (Proof of Concept Code) The POC code demonstrates how to trigger the command injection vulnerability by constructing specific HTTP requests and executing arbitrary commands. It includes logic for request construction and response handling against the target system. Exploitation Evidence Screenshot Display: Provides screenshots showing successful command execution via the vulnerability, displaying the results of executed commands. Video Link: Includes a video link demonstrating the exploitation process, detailing step-by-step how the vulnerability is exploited. System Information Operating System: Ubuntu 20.04 LTS Middleware: Nginx 1.18.0, uWSGI 2.0.19.1 References Related Links: Provides additional references and links related to this vulnerability. Mitigation Measures Upgrade Recommendation: Users are advised to upgrade to the latest version of Calibre Web as soon as possible to remediate the vulnerability. Security Policy: Highlights Fluid Attacks' security policy and reporting procedures. Acknowledgments Discoverer: Adam Caudill ``` These key details help security teams quickly understand the severity, scope of impact, and protective measures for this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Calibre Web 0.6.24 Blind Command Injection Vulnerability (CVE-2021-39585) Analysis and POC