Arbitrary Code Execution in Calibre via Malicious EPUB Metadata

Executive Summary

This vulnerability exists in calibre versions prior to 9.10.0, an e-book manager. A malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre. This happens because the file can embed a custom column definition using a python: template in calibre:user_metadata, which is passed unsanitized to the exec() function in the template formatter.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows execution of arbitrary Python code with limited privileges when a malicious e-book file is processed by calibre. This can lead to unauthorized actions on the affected system, potentially compromising data integrity, confidentiality, or availability depending on the code executed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade calibre to version 9.10.0 or later, where the issue is fixed.

Avoid opening or importing EPUB, OPF, or PDF files from untrusted sources until the upgrade is applied.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in calibre allows arbitrary code execution when processing malicious e-book files, which can lead to unauthorized actions on the affected system. This poses significant risks to the confidentiality, integrity, and availability of data handled by the software.

Such risks can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access or processing. If exploited, this vulnerability could lead to data breaches or unauthorized data manipulation, thereby violating these regulatory requirements.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered when calibre reads metadata from malicious EPUB, OPF, or PDF files containing embedded Python code in the calibre:user_metadata field. Detection involves identifying such crafted files before they are processed by calibre.

Since the exploit relies on opening or adding malicious e-book files to calibre, network detection is limited. Instead, detection should focus on scanning files for suspicious python: templates or embedded Python code in metadata fields.

You can use commands to inspect EPUB or PDF files for suspicious metadata content. For example:

• For EPUB files (which are ZIP archives), unzip and inspect the OPF metadata file for 'python:' templates:
• unzip -p suspicious.epub content.opf | grep 'python:'
• For PDF files, extract XMP metadata and search for 'python:' templates:
• pdfxmpextract suspicious.pdf | grep 'python:'

Alternatively, use tools like 'strings' or metadata extraction utilities to search for 'python:' in user metadata fields.

Note that these commands help identify potentially malicious files before they are opened in calibre, mitigating risk of code execution.

Useful 0 Not Useful 0