REDHAT-BUG-2552693: Medium severity Gnome evolution-data-server vulnerability
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events. This vulnerability affects evolution-data-server versions 3.26 through 3.62.0 and is fixed in version 3.62.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
evolution-data-serverto a version that resolves this vulnerability.Fixed in 3.62.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of evolution-data-server versions 3.26 through 3.62.0 who access a shared CalDAV calendar are exposed. An attacker needs access to that shared calendar to place a malicious event in it.
What user action triggers file disclosure?
The malicious event causes a local file referenced by its ATTACH file:// URI to be read and uploaded when the event is saved. The disclosed file is limited by the permissions of the user running evolution-data-server.
Are file paths restricted or validated before upload?
No. The affected versions have no file path restrictions and do not verify that an attachment originated from the server rather than being added locally.
What version contains the fix?
The issue is fixed in evolution-data-server version 3.62.1. Systems running versions 3.26 through 3.62.0 should be considered affected.