Authorization Bypass in Easy!Appointments via Booking::register()

Executive Summary

This vulnerability is an authorization bypass in Easy!Appointments through version 1.6.0. It allows unauthenticated attackers to modify any appointment by providing an appointment ID without its hash. Attackers can enumerate sequential IDs and use a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled accounts, and obtain management hashes for rescheduling or cancellation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized POST requests to /index.php/booking/register with sequential appointment IDs and a manage_mode flag. Check server logs for repeated requests modifying appointment details without authentication. Test by attempting to modify an appointment with a guessed ID to see if changes succeed without proper validation.

Useful 0 Not Useful 0

Impact Analysis

Attackers can hijack appointments, steal sensitive data, manipulate schedules, and cancel or reschedule appointments without authorization. They can also overwrite customer PII like names, phone numbers, and addresses by submitting a victim's email address. The default configuration with booking enabled and CAPTCHA disabled exposes these attack paths.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized access to and modification of personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access or alteration of such data may result in non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 09c6fb3 to enforce hash validation for rescheduling and remove ID parameters for new bookings. Disable the booking/register endpoint if not in use. Enable CAPTCHA and enforce strict CSRF checks. Monitor for suspicious activity and revoke any compromised appointment hashes.

Useful 0 Not Useful 0