Server-Side Request Forgery in calibreweb

The SSRF vulnerability in CalibreWeb allows an attacker to craft malicious requests that appear to originate from the server itself. This can be exploited to access internal services that are not directly exposed to the internet, such as databases, administration panels, or other internal APIs. By crafting a payload resolving to 0.0.0.0, an attacker can bypass the intended filtering and effectively make requests to localhost. This could lead to unauthorized access to sensitive data, modification of system configurations, or even remote code execution depending on the internal services accessible. The impact is particularly severe given CalibreWeb's role as an eBook server, often deployed in environments with sensitive user data.

Organizations and individuals using calibreweb for ebook management, particularly those hosting the application internally or in shared hosting environments, are at risk. Users relying on calibreweb to manage sensitive library data or integrate with internal systems are especially vulnerable.

• linux / server: Monitor calibreweb access logs for requests containing 0.0.0.0 or other suspicious hostnames. Use journalctl -u calibreweb to check for error messages related to request forwarding.

grep '0.0.0.0' /var/log/calibreweb/access.log

• generic web: Use curl to attempt a request to calibreweb with 0.0.0.0 as the hostname and verify that it is blocked.

curl -v http://your-calibreweb-server/0.0.0.0

1. 2022-03-08Disclosure

   disclosure

2. 2022-03-08Patch

   patch

1. Reserviert2022-02-26
2. Veröffentlicht2022-03-08
3. Geändert2025-02-18
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2022-0766 is to upgrade CalibreWeb to version 0.6.17 or later, which includes the corrected blacklist implementation. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block requests containing 0.0.0.0 or other suspicious hostnames. Additionally, restrict network access to CalibreWeb from external sources using firewall rules. Regularly review CalibreWeb's configuration to ensure that only necessary services are exposed and that access controls are properly enforced. After upgrading, confirm the fix by attempting a request to localhost through CalibreWeb and verifying that it is blocked.