Attack Chain

1. An attacker identifies a vulnerable Cal.com instance (version <= 4.7.15).
2. The attacker registers or gains access to create new event types within the Cal.com instance.
3. During the creation or modification of an event type, the attacker crafts a malicious payload (e.g., <script>alert(document.domain)</script> or a more sophisticated script) and inputs it into a "booking question label" field.
4. The Cal.com application stores this malicious content in its database without adequately sanitizing the input.
5. The attacker then obtains the URL for the publicly accessible single booking view associated with the compromised event type (e.g., /booking/<id>).
6. The attacker distributes this malicious booking view URL to a victim, typically via social engineering or a direct link.
7. When the victim visits the provided booking view URL, the Cal.com application fetches the stored malicious "booking question label."
8. The application renders the page using React's dangerouslySetInnerHTML method, which directly embeds the unsanitized malicious HTML/JavaScript into the victim's browser, leading to client-side code execution.

Impact

Successful exploitation of CVE-2024-58353 allows attackers to execute arbitrary HTML and JavaScript in the context of the victim's browser. The direct consequences can include session hijacking, enabling attackers to impersonate the victim, or website defacement. More advanced attacks could involve redirecting users to malicious sites, stealing sensitive data (e.g., cookies, local storage), or performing actions on behalf of the victim through their authenticated session. Self-hosted Cal.com instances with open registration are particularly vulnerable due to the ease with which attackers can create malicious event types.

Recommendation

• Upgrade Cal.com instances to version 4.7.16 or later immediately to patch CVE-2024-58353.
• Implement Content Security Policy (CSP) headers across all web applications to mitigate the impact of XSS vulnerabilities by restricting script sources.
• Ensure proper input validation and output encoding are enforced for all user-supplied data in web applications, especially in fields like the "booking question label" mentioned in the CVE-2024-58353 description.