SVI/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE.git synced 2026-07-31 01:48:24 -04:00
Code Issues 2.6k Packages Projects Releases 10 Wiki Activity

[PR #6257] [MERGED] Calibre-Web: Remove from Frontend during Critical Security Issues #6500

New Issue
Closed
opened 2025-11-20 07:10:52 -05:00 by saavagebueno · 0 comments
saavagebueno commented 2025-11-20 07:10:52 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/community-scripts/ProxmoxVE/pull/6257
Author: @MickLesk
Created: 7/26/2025
Status: ✅ Merged
Merged: 7/26/2025
Merged by: @michelroegl-brunner

Base: main ← Head: calibre

📝 Commits (1)

  • ae55ec0 Calibre-Web: Remove from Frontend during Critical Security Issues

📊 Changes

2 files changed (+0 additions, -107 deletions)

View changed files

➖ frontend/public/json/calibre-web.json (+0 -40)
➖ install/calibre-web-install.sh (+0 -67)

📄 Description

✍️ Description

remove Calibre Web from Frontend and Backup Install File

"2 weeks ago a security team attempted to make contact with the Calibre-Web dev and received no response. Today they have published the details of two vulnerabilities in the application, you can read about them here and here.

Since Calibre-Web hasn't had an update in some time, these vulnerabilities remain in the stable release that is used by the Helper Script.

Some info about the vulns:

  • the Blind Command Injection vulnerability requires a malicious, authenticated Admin user to set the path to a malicious command or script. The vulnerable function will blindly execute the command, since there is no validation. It's possible to get a reverse shell via this method, but again, this can only be achieved by authenticated admins, so it's mitigated somewhat.
  • the reDOS vulnerability allows any unauthenticated attacker to cause a denial of service by sending specially crafted input to the login form. Since this is possible without any authentication, Calibre-Web instances open to the internet are definitely vulnerable to this.

As far as I can tell, these vulns have only been patched in Autocaliweb - a fork of Calibre-Web and Calibre-Web Automated."

🔗 Related PR / Issue

Link: #6249

✅ Prerequisites (X in brackets)

  • Self-review completed – Code follows project standards.
  • Tested thoroughly – Changes work as expected.
  • No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

🛠️ Type of Change (X in brackets)

  • 🐞 Bug fix – Resolves an issue without breaking functionality.
  • ✨ New feature – Adds new, non-breaking functionality.
  • 💥 Breaking change – Alters existing functionality in a way that may require updates.
  • 🆕 New script – A fully functional and tested script or script set.
  • 🌍 Website update – Changes to website-related JSON files or metadata.
  • 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
  • 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/community-scripts/ProxmoxVE/pull/6257 **Author:** [@MickLesk](https://github.com/MickLesk) **Created:** 7/26/2025 **Status:** ✅ Merged **Merged:** 7/26/2025 **Merged by:** [@michelroegl-brunner](https://github.com/michelroegl-brunner) **Base:** `main` ← **Head:** `calibre` --- ### 📝 Commits (1) - [`ae55ec0`](https://github.com/community-scripts/ProxmoxVE/commit/ae55ec0d850bab54e9470bbc649cc1c733c39df4) Calibre-Web: Remove from Frontend during Critical Security Issues ### 📊 Changes **2 files changed** (+0 additions, -107 deletions) <details> <summary>View changed files</summary> ➖ `frontend/public/json/calibre-web.json` (+0 -40) ➖ `install/calibre-web-install.sh` (+0 -67) </details> ### 📄 Description ## ✍️ Description remove Calibre Web from Frontend and Backup Install File "2 weeks ago a security team attempted to make contact with the Calibre-Web dev and received [no response](https://github.com/janeczku/calibre-web/issues/3427). Today they have published the details of two vulnerabilities in the application, you can read about them [here](https://fluidattacks.com/advisories/megadeth) and [here](https://fluidattacks.com/advisories/kino). Since Calibre-Web hasn't had an update in some time, these vulnerabilities remain in the stable release that is used by the Helper Script. Some info about the vulns: - the Blind Command Injection vulnerability requires a malicious, authenticated Admin user to set the path to a malicious command or script. The vulnerable function will blindly execute the command, since there is no validation. It's possible to get a reverse shell via this method, but again, this can only be achieved by authenticated admins, so it's mitigated somewhat. - the reDOS vulnerability allows any unauthenticated attacker to cause a denial of service by sending specially crafted input to the login form. Since this is possible without any authentication, Calibre-Web instances open to the internet are definitely vulnerable to this. As far as I can tell, these vulns have only been patched in [Autocaliweb](https://github.com/gelbphoenix/autocaliweb) - a fork of Calibre-Web and Calibre-Web Automated." ## 🔗 Related PR / Issue Link: #6249 ## ✅ Prerequisites (**X** in brackets) - [x] **Self-review completed** – Code follows project standards. - [x] **Tested thoroughly** – Changes work as expected. - [x] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues. --- ## 🛠️ Type of Change (**X** in brackets) - [ ] 🐞 **Bug fix** – Resolves an issue without breaking functionality. - [ ] ✨ **New feature** – Adds new, non-breaking functionality. - [x] 💥 **Breaking change** – Alters existing functionality in a way that may require updates. - [ ] 🆕 **New script** – A fully functional and tested script or script set. - [ ] 🌍 **Website update** – Changes to website-related JSON files or metadata. - [ ] 🔧 **Refactoring / Code Cleanup** – Improves readability or maintainability without changing functionality. - [ ] 📝 **Documentation update** – Changes to `README`, `AppName.md`, `CONTRIBUTING.md`, or other docs. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
saavagebueno added the pull-request label 2025-11-20 07:10:52 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🛑 Failure to comply with the guidelines
breaking change
bug
bug
bugfix
deferred
delete script
dependencies
enhancement
external
feature
github
help wanted
Implemented in VED waiting push to Main
in project pipeline
invalid
investigation
json
maintenance
new script
new script
nice to have
not a script issue
not planned
organization
pull-request
Mirrored from GitHub Pull Request
 question
refactor
rename script
security
update script
website
wontdo
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/ProxmoxVE#6500
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?