CVE-2021-25965: 
NixOS vulnerability analysis and mitigation

CVE-2021-25965 affects Calibre-web versions 0.6.0 to 0.6.13, which contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was disclosed on November 16, 2021, and allows an attacker to create a new user role with admin privileges by tricking an authenticated user into clicking a malicious link (WhiteSource DB).

The vulnerability has a CVSS v3.1 Base Score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is network-based, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with high impact on confidentiality, integrity, and availability (NVD).

If successfully exploited, the vulnerability allows an attacker to create a new administrative user with attacker-controlled credentials, effectively enabling them to take over the application with full administrative privileges (WhiteSource DB).

The vulnerability can be exploited by creating a malicious HTML file containing a CSRF payload and hosting it on an attacker-controlled server. When an authenticated admin user clicks on the malicious link, the payload executes and creates a new admin user with attacker-specified credentials (WhiteSource DB).

The vulnerability has been fixed in Calibre-web version 0.6.14. Users should upgrade to this version or later to mitigate the risk. The fix implements CSRF protection using flask-wtf (GitHub Patch).