Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4164

CVE-2021-4164: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)

7.6

CVSS Score
3.0

Basic Information

CVE ID
CVE-2021-4164
GHSA ID
GHSA-wxr6-29pv-ch68
EPSS Score
0.33127%
CWE
CWE-352
Published
1/21/2022
Updated
2/3/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
calibrewebpip< 0.6.150.6.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from state-changing operations accepting GET requests without CSRF protection. The patch migrates these routes to POST and adds CSRF token checks. Key indicators include: 1) Route decorators changed from @route('/path') to @route('/path', methods=['POST']), 2) JavaScript AJAX calls updated from GET to POST, 3) Form CSRF tokens added in templates. Functions handling destructive operations (deletion(), shutdown(), sync()) via GET in vulnerable versions are clear CSRF targets.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**li*r*-w** is vuln*r**l* to *ross-Sit* R*qu*st *or**ry (*SR*)

Reasoning

T** vuln*r**ility st*ms *rom st*t*-***n*in* op*r*tions ****ptin* **T r*qu*sts wit*out *SR* prot**tion. T** p*t** mi*r*t*s t**s* rout*s to POST *n* ***s *SR* tok*n ****ks. K*y in*i**tors in*lu**: *) Rout* ***or*tors ***n*** *rom `@rout*('/p*t*')` to `