# You Have One New Appwntment: Exploiting iCalendar Properties in Enterprise Applications

Multiple iCalendar parser flaws across VMware Boxer, Synology Calendar, Apple Calendar, Outlook, Google Calendar and NextCloud enable stored XSS, SMTP injection, and arbitrary URI/iframe loading.

- Payout: Research
- Severity: high
- Program: iCalendar
- Write-up by: Eugene Lim
- Disclosed: 2022-08-18
- CVE: CVE-2022-22944, CVE-2022-22682, CVE-2022-24838, CVE-2022-31014
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/exploiting-icalendar-properties-enterprise-applications/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-exploiting-icalendar-properties-enterprise-applications
- Tags: area:os domain:desktop domain:web impact:ato impact:data-leak kind:research platform:research sev:high tech:email technique:legacy-endpoint technique:source-review vuln:command-injection vuln:info-disclosure vuln:xss

**Target:** iCalendar parsers in enterprise calendar clients (VMware Boxer, Synology Calendar, Apple Calendar, Outlook, Google Calendar, NextCloud)
**Root cause:** Vendors implement RFC 5545 properties inconsistently and add undocumented proprietary X- properties; fields like DESCRIPTION, ATTENDEE/ORGANIZER, ATTACH and X-GOOGLE-CALENDAR-CONTENT-* are rendered or passed to SMTP/URI handlers without sanitization.
**Steps:**
1. Craft VEVENT with DESCRIPTION containing HTML/iframe for VMware Boxer stored XSS.
2. For Synology, set ORGANIZER/ATTENDEE to `mailto:<iframe srcdoc="<script src='data:text/javascript,...'>"></iframe>@test.local` to bypass CSP via data: script-src.
3. For Apple Calendar, set DESCRIPTION to `----( FaceTime )----\n[FaceTime]\nFiLe:///System/Applications/Calculator.app\n---===---` to trigger custom URI launch.
4. For NextCloud, set ORGANIZER to `mailto:janedoe(\nEHLO a\n)@example.com` and send as .ics attachment; victim RSVP triggers SMTP command injection.
5. For Outlook, set X-MS-OLK-MWSURL to an SMB/HTTP URL to leak Net-NTLMv2 or send SOAP SetAttendeeResponse to attacker host.
6. For Google Calendar, set X-GOOGLE-CALENDAR-CONTENT-URL to `https://evilhost.com/exploit.html` with TYPE text/html to embed arbitrary iframe.
**How found:** Systematic review of RFC 5545 implementations and proprietary X- properties; noted 'one standard, many interpretations' and dormant legacy properties (zombie properties) still parsed after deprecation; fuzzed DESCRIPTION, ATTENDEE/ORGANIZER, ATTACH, and X-GOOGLE-CALENDAR-CONTENT-* fields.
**Exploitation:** Attacker sends crafted .ics invitation; victim's client auto-adds event or user clicks RSVP, triggering XSS, SMTP injection, custom URI launch, or remote iframe/icon load without further interaction.
**Escalation:** Synology XSS is wormable due to auto-add of invitations; Apple custom URI chains to code execution via Safari UXSS or Gatekeeper bypass; Outlook MWSURL chains to NTLM hash leak or SOAP de-anonymization.
**Insight:** Legacy/deprecated proprietary X- properties (e.g. X-MS-OLK-MWSURL, X-GOOGLE-CALENDAR-CONTENT-*) often remain parsed in current clients; test them for URI launch, iframe embedding, and SMTP injection even when the feature is 'removed'. Also test newline injection in quoted-string email addresses in ATTENDEE/ORGANIZER for SMTP pipelining.