External risk intelligence

Cal.com Stored Cross-Site Scripting in Booking Questions

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2024-58355

The vulnerability exists in Cal.com, a scheduling platform designed to be publicly accessible via the internet for booking events. The affected booking view is inherently a public-facing web endpoint intended for external users to interact with the service.

Cross-site Scripting

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in the Cal.com scheduling platform, specifically within its booking question feature. This flaw could allow an attacker to inject malicious code that executes when a user accesses a crafted booking link, potentially impacting user experience and data integrity.

A flaw allows injecting malicious code into booking links.
High risk to user experience and data integrity if exploited.
Confirm relevance and verify exposure across affected systems.

Attack Path

How an attacker could exploit the issue

An attacker with a low level of access can create an event type with a malicious label in the booking question field. When a victim views the booking page for this event, the injected HTML or JavaScript code will execute in their browser. This could lead to the theft of sensitive information or further compromise of the victim's session.

Requires a logged-in user account.
Triggered by a victim visiting a crafted booking URL.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A stored cross-site scripting vulnerability in Cal.com could allow an attacker to inject arbitrary HTML and JavaScript into booking question labels. This malicious content could execute when a victim accesses a crafted booking URL, potentially impacting the user's session or redirecting them to a malicious site when supported by the advisory.

User session data.
Malicious script injection via booking URL.
Potential for session hijacking or redirection.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application or platform owner is responsible for this vulnerability, as it affects the Cal.com scheduling platform. The first practical step is to identify all instances of the affected technology, assess their reachability and business criticality, and then confirm the accountable owner for remediation planning.

Application owners should own the issue.
Verify public-facing booking views are identified.
Plan remediation based on identified exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com?

Cal.com is a scheduling platform used to manage and book meetings. It allows users to create event types and share booking links with others, who then fill out forms to confirm a time. The application is typically deployed to handle calendar integrations and coordinate appointments, often functioning as a web-based service that exposes specific booking pages to external users or clients.

What does CWE-80 mean for CVE-2024-58355?

CWE-80 refers to Improper Neutralization of Script-Related HTML Tags in a Web Page, commonly known as Stored Cross-Site Scripting (XSS). In the context of CVE-2024-58355, this means the software fails to clean or sanitize text entered into booking-question fields. Because the application uses a function that renders this input directly as raw HTML, any malicious scripts embedded by a user are stored by the system and then executed in the browser of anyone who views that specific booking page.

How is this XSS vulnerability triggered?

An attacker must first have a logged-in user account to create an event type with a malicious booking-question label. The vulnerability is not triggered by simply having the software installed; it requires a victim to visit the specific, crafted booking URL associated with that malicious event. If a victim never navigates to a booking page containing the tainted label, the embedded script will not execute in their browser.

Is my Cal.com instance at risk?

According to Halo Surface Signal, this vulnerability is very likely to be relevant if your instance is internet-facing. Because Cal.com is designed for external scheduling, these booking views are often public by default. If your deployment allows users to create event types and share links with people outside your organization, your booking pages are reachable, making it important to evaluate your current version against this threat.

What should I do to address this vulnerability?

The primary step is to identify all running instances of Cal.com to determine if they are on an affected version. Since the issue is resolved in version 4.7.16, administrators should prioritize updating their software to this version or higher. Coordinate with the teams responsible for your scheduling infrastructure to verify your current version and schedule the necessary update to ensure user input is properly sanitized.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.