Cal.com Stored Cross-Site Scripting Vulnerability (CVE-2024-58355)

Cal.com (calcom/cal.diy) versions through 4.7.15 are affected by a stored cross-site scripting (XSS) vulnerability, tracked as CVE-2024-58355. This flaw stems from improper sanitization of user-supplied input when rendering booking-question field labels via React's dangerouslySetInnerHTML function within the single booking view (e.g., https://app.cal.com/booking/<id>). An attacker with the ability to create an event type can craft a malicious booking-question label containing arbitrary HTML or JavaScript. When a victim subsequently accesses the specially crafted booking URL, the embedded script executes in their browser context. This client-side code execution can lead to various malicious activities, including session hijacking, data exfiltration, or defacement of the victim's browser session. The vulnerability was discovered and subsequently patched in Cal.com version 4.7.16, making an update critical for all affected instances.

Attack Chain

1. An attacker creates a new event type within the vulnerable Cal.com application.
2. During the event type creation, the attacker embeds malicious HTML or JavaScript code into the booking-question label field.
3. The Cal.com application stores this unsanitized malicious payload in its database.
4. The attacker shares the URL to the crafted single booking view (e.g., https://app.cal.com/booking/<id>) with a target victim.
5. The victim navigates to the provided booking URL in their web browser.
6. The Cal.com application retrieves the stored, malicious booking-question label and renders it on the page using React's dangerouslySetInnerHTML without proper sanitization.
7. The embedded arbitrary HTML or JavaScript code executes within the victim's browser context.
8. The attacker's script performs actions such as stealing session cookies, redirecting the user, or defacing the webpage, achieving impact.

Impact

Successful exploitation of CVE-2024-58355 allows for client-side code execution in the context of the victim's browser session. This can lead to a range of severe consequences for individual users and potentially the organization using Cal.com. Attackers can hijack user sessions, gaining unauthorized access to their Cal.com accounts or other services if single sign-on is used. Sensitive data, including personal information or meeting details, could be exfiltrated to attacker-controlled infrastructure. Additionally, the attacker could deface the web interface, perform phishing attacks, or redirect users to malicious websites, undermining user trust and the integrity of the Cal.com platform.

Recommendation

• Patch CVE-2024-58355 immediately by upgrading all Cal.com instances to version 4.7.16 or newer.
• Implement a Web Application Firewall (WAF) to detect and block common XSS payloads in HTTP request parameters, specifically those targeting input fields that could be rendered unsanitized, even though this is a stored XSS, WAFs can add a layer of protection during initial payload submission.
• Review web server access logs for requests related to event creation or booking configurations (/booking/<id>) that contain unusual characters or script patterns in query strings or post bodies, indicating potential XSS payload attempts.