You Have 1 New Appwntment: Hacking Proprietary iCalendar Properties
Eugene Lim (spac3sc) explores vulnerabilities in the ubiquitous iCalendar (.ics) standard, demonstrating zero-click XSS, RCE, and credential theft via calendar invites.
Summary
The Ubiquitous and Insecure iCalendar Standard
First standardized in 1998, the iCalendar (.ics) specification is universally supported by email clients, mobile operating systems, and enterprise scheduling software.
Auditing Proprietary Vendor Extensions and Parsers
Eugene Lim analyzes how major vendors implement custom, undocumented X-properties, leading to parsing inconsistencies and injection vulnerabilities.
Demonstrating Zero-Click Exploits via Calendar Invites
Lim showcases real-world exploit chains across popular email clients and web apps—triggering stored cross-site scripting (XSS), URL scheme handler hijacking, and remote code execution.
Hardening Calendar Ingestion Pipelines
The author outlines essential parsing sanitization standards, Content Security Policy adjustments, and safe calendar processing practices.
Related talks
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Main Stage·38 min
Zhengyu Liu · Jianjia Yu
Introduces Hulk, the first dynamic analysis tool to automatically detect and generate exploit payloads for complex DOM Clobbering vulnerabilities at web scale.
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).