Summary

Opening an ebook with malicious scripts inside leads to code execution inside the browsing context.
Testing was done on version 0.8.0.0 on Windows.

Details

Kavita doesn't sanitize or sandbox the contents of epubs (as far as I can tell). This allows scripts inside ebooks to execute.
While this is expected behavior, it allows malicious scripts to perform every action that the logged in user can perform.

Because the functionality exposed by Kavita's API endpoints is quite limited when it comes to the server itself (which is a good thing!), I was only able to use this vulnerability to leak the email credentials.

PoC

An ebook can be crafted with Calibre to include this bare minimum script:

const token = JSON.parse(localStorage.getItem("kavita-user")).token;
const headers = { Authorization: `Bearer ${token}` };
const rawResponse = await fetch("/api/settings", { headers });
const response = await rawResponse.json();
const { userName, password } = response.smtpConfig;
alert(`Username: ${userName}, Password: ${password}`);

Impact

Users have to open a malicious file.
However, the attacker doesn't have to prepare a book specifically for Kavita, but can use some fingerprinting to determine in what environment it's running.

Distribution of malicious books could be done via pirate sites or even (online) conversion services, which could inject those malicious scripts.

Usually code execution within an admin session leads to remote code execution on the server itself because of too much exposed functionality via API endpoitns. However, Kavita seems quite solid in this regard.

Overall, I wouldn't be too worried. :^)

Some ideas

In an ideal world, scripted content would be turned off (e.g. via an iframe's sanbox attribute).
There are, however, limitations with that approach.
The author of foliate sums it up nicely here.
Maybe the user could be given the option to toggle scripted content.

Server-side sanitization is another option.

That's it! If something's unclear, please ask away.

Cheers
Frederic

PS: Audio warning for the PoC video!