SabreDAV Deployments Need an Endpoint and Auth Backend Review
SabreDAV Deployments Need an Endpoint and Auth Backend Review SabreDAV is a PHP library used to build WebDAV, CalDAV, and CardDAV servers. It is often embedded inside a larger application, which means an inventory may
SabreDAV Deployments Need an Endpoint and Auth Backend Review
SabreDAV is a PHP library used to build WebDAV, CalDAV, and CardDAV servers. It is often embedded inside a larger application, which means an inventory may find the DAV protocol before it can identify the product. A standard DAV response header proves that a server speaks WebDAV. It does not prove that the implementation is SabreDAV or that the endpoint is safe.
The bounded query on 15 November 2026 found 0 matches for app="SabreDAV", 10 for title="SabreDAV", and 2,313 for http.header="SabreDAV" with sub_type=all, page 1, and page size 1. The header count is a stronger product clue than a generic DAV header, but it still needs owner confirmation. The exact title count is very small and should not be inflated by treating every WebDAV server as SabreDAV.
Authentication is application code
SabreDAV documents several authentication backends, including an Apache backend, a callback backend, file or PDO Digest backends, and an IMAP Basic backend. The authentication plugin is required for CalDAV and CardDAV. The application chooses the backend and supplies the user resolution logic, so two deployments with the same library version can have very different authorization behavior.
Review the public DAV endpoint, principal discovery, the authentication backend, and the ACL plugin. Confirm that a principal URL does not let a user enumerate every account and calendar. Test a valid user against another user's calendar, a revoked credential, a share that was removed, and a request without authentication. Check PROPFIND, REPORT, PUT, and DELETE separately.
Reverse-proxy authentication needs extra care. If the web server passes a username header to PHP, the PHP application must trust it only when the request came from the proxy and the client could not set that header directly. A FastCGI or Apache configuration that strips authentication headers can otherwise turn a valid proxy identity into an unauthenticated request.
Inventory the application around the library
Record the hostname, application owner, SabreDAV version, authentication backend, principal base URL, reverse proxy, storage backend, and enabled plugins. Review every plugin that can expose files, calendars, contacts, or sharing links. A library-level version match does not identify which product built the endpoint.
The 2,313 header observations are useful for finding candidates and reviewing DAV exposure patterns. They are not a vulnerability count. The owner should verify the product and test the authenticated routes directly. The key question is who can resolve a principal, read a collection, or change a resource through the application's chosen backend.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.